How to detect domain fronting

[AndreasB]

Hi,

did anyone manage to write a custom signature to detect domain fronting?

PA extracts the Host header, so in theory it should be possible to detect if the Host header is different from the URL?

Alternatively, if one could log the Host header one could develop external detection logic in a SIEM.

Regards,

    Andreas

[mivaldi]

Check Anti-spyware signature 14984.

Documentation is available at:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/threat-prevention/enable-evasion-signature...

[bgriffin]

My customer had a query how PA detects Domain Fronting in PanOS, how it is logged and how it can be mitigated.  This document helped: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-new-features/content-inspection-features/domain...