H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Mitigation

Domain Fronting Mitigation

If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be Domain Fronting. In order to use domain fronting, attackers will likely need to deploy additional tools to compromised systems. (Citation: FireEye APT29 Domain Fronting With TOR March 2017) (Citation: Mandiant No Easy Breach) It may be possible to detect or prevent the installation of these tools with Host-based solutions.

Mitigation
TypeMitigation
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be Domain Fronting. In order to use domain fronting, attackers will likely need to deploy additional tools to compromised systems. (Citation: FireEye APT29 Domain Fronting With TOR March 2017) (Citation: Mandiant No Easy Breach) It may be possible to detect or prevent the installation of these tools with Host-based solutions.

0 recorded

Relationships

No relationships recorded.

3 external

References

mitre-attack
T1172
open
FireEye APT29 Domain Fronting With TOR March 2017
https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
open
Mandiant No Easy Breach
http://www.slideshare.net/MatthewDunwoody1/no-easy-breach-derby-con-2016
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance