How to Detect Domain Fronting

Domain Fronting is a TLS evasion technique that circumvents URL filtering and facilitates data exfiltration. An attacker can place a benign FQDN in the Server Name Indication (SNI) while surreptitiously connecting to a different destination via the HTTP Host header.

This article provides step-by-step guidance on how to detect and prevent Domain Fronting traffic within your enterprise network using Palo Alto Networks Threat Prevention.

• Palo Alto Networks Next-Generation Firewalls (NGFW)
• PAN-OS Version: 10.2.1 or later

1. Ensure TLS Decryption is Active: TLS traffic must be decrypted using SSL Decryption. Both SSL Inbound Inspection and SSL Forward Proxy decryption modes are supported.
2. Enable Handshake Inspection: Navigate to Device > Setup > Session > Decryption Settings > SSL Decryption Settings, then enable Send handshake messages to CTD for inspection.
   
3. Configure Threat Exceptions: Detection is driven by Anti-Spyware signature ID 86467. By default, its severity is set to Informational and its action to Allow. To take active enforcement (such as blocking or alerting), you must create a Threat Exception in your Anti-Spyware profile to override the default action according to your organization's security policy.