HTTP client fronting a CDN edge with an overridden Host header

Siemphony@siemphonylowT1090.004unverifiedPlaybook · Command and control

Domain fronting is a mismatch between the TLS SNI and the HTTP Host header, and no single log source in this brief holds both fields. Sysmon EventID 3 records socket endpoints only and EventID 22 records `QueryName`, so neither Windows source can express the mismatch at all; Zeek carries `server_name` in ssl.log and `host` in http.log, but those are two separate log sources and Sigma cannot join them. What is left, and what AN0565 names explicitly, is the client side: `curl` or `wget` dialling an HTTPS URL whose hostname is a CDN edge while forcing a different Host header, which is the client-side shape of the SNI/Host mismatch. Both halves are required. The Host override alone is connection testing; `--resolve` and `--connect-to` are deliberately not selectors at all, because they change only the address dialled while SNI and the Host header both stay the URL's hostname — that is connection pinning, not fronting. The CDN list is the inverse use of MITRE's CDNAllowList knob, which names front-end domains to reason about; the four values below are populated here rather than sourced from MITRE, and an estate should add its own edge hostnames. Related but distinct: the T1001.003 rule in this corpus matches the same tools overriding Host to impersonate a named cloud API, with no CDN residency requirement; the CDN gate here is what makes a match evidence of fronting rather than of impersonation. This sees the invocation, not the fronting — an implant that fronts from inside its own code, a request without an explicit `https://` scheme, a front on a CDN not listed, and MITRE's empty-SNI "domainless" variant all pass without a match. On Alpine and other BusyBox userlands `wget` is an applet, so execve records `/bin/busybox`, which is why it is in the tool list; BusyBox wget supports only the `--header=Host:` form of the three. Prerequisite: auditd ships no execve rule by default, so without an explicit -a always,exit -F arch=b64 -S execve there is no process_creation telemetry on the host at all and this rule returns zero rows regardless of what ran. It also assumes a feed that reconstructs `CommandLine` from the a0..aN fields and hex-decodes them: auditd hex-encodes any argument containing whitespace, so on a raw feed the `-H 'Host: front.example'` form arrives as hex and only the whitespace-free `-H Host:front.example` form still matches. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0196, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: HTTP client fronting a CDN edge with an overridden Host header2id: a4491efb-bb50-4bfd-85aa-d33e2bf6c0d23status: experimental4description: |5  Domain fronting is a mismatch between the TLS SNI and the HTTP Host header,6  and no single log source in this brief holds both fields. Sysmon EventID 37  records socket endpoints only and EventID 22 records `QueryName`, so neither8  Windows source can express the mismatch at all; Zeek carries `server_name` in9  ssl.log and `host` in http.log, but those are two separate log sources and10  Sigma cannot join them. What is left, and what AN0565 names explicitly, is the11  client side: `curl` or `wget` dialling an HTTPS URL whose hostname is a12  CDN edge while forcing a different Host header, which is the client-side shape13  of the SNI/Host mismatch. Both halves are required. The Host override alone is14  connection testing; `--resolve` and `--connect-to` are deliberately not15  selectors at all, because they change only the address dialled while SNI and16  the Host header both stay the URL's hostname — that is connection pinning, not17  fronting. The CDN list is the inverse use of MITRE's CDNAllowList knob, which18  names front-end domains to reason about; the four values below are populated19  here rather than sourced from MITRE, and an estate should add its own edge20  hostnames. Related but distinct: the T1001.003 rule in this corpus matches the21  same tools overriding Host to impersonate a named cloud API, with no CDN22  residency requirement; the CDN gate here is what makes a match evidence of23  fronting rather than of impersonation. This sees the invocation, not the24  fronting — an implant that fronts from inside its own code, a request without25  an explicit `https://` scheme, a front on a CDN not listed, and MITRE's26  empty-SNI "domainless" variant all pass without a match. On Alpine and other27  BusyBox userlands `wget` is an applet, so execve records `/bin/busybox`, which28  is why it is in the tool list; BusyBox wget supports only the29  `--header=Host:` form of the three. Prerequisite: auditd ships no execve rule30  by default, so without an explicit -a always,exit -F arch=b64 -S execve there31  is no process_creation telemetry on the host at all and this rule returns zero32  rows regardless of what ran. It also assumes a feed that reconstructs33  `CommandLine` from the a0..aN fields and hex-decodes them: auditd hex-encodes34  any argument containing whitespace, so on a raw feed the35  `-H 'Host: front.example'` form arrives as hex and only the whitespace-free36  `-H Host:front.example` form still matches.37  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0196, not hand-written and not tested by its author. Any lab result is on this rule's own page.38references:39  - https://attack.mitre.org/techniques/T1090/00440  - https://attack.mitre.org/detectionstrategies/DET019641author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)42date: 2026-08-1643tags:44  - attack.command-and-control45  - attack.t1090.00446logsource:47  category: process_creation48  product: linux49detection:50  selection_client:51    Image|endswith:52      - '/curl'53      - '/wget'54      - '/busybox'55  selection_host_override:56    CommandLine|contains:57      - '-H Host:'58      - '-HHost:'59      - '--header=Host:'60  selection_tls:61    CommandLine|contains: 'https://'62  selection_cdn:63    CommandLine|contains:64      - 'cloudfront.net'65      - 'azureedge.net'66      - 'fastly.net'67      - 'akamaihd.net'68  condition: selection_client and selection_host_override and selection_tls and selection_cdn69falsepositives:70  - "Pre-cutover verification of a CDN distribution, where an operator or a deployment script curls the distribution hostname over HTTPS and supplies the production hostname as a Host header because no CNAME exists yet. This is the documented way to test a CloudFront or Azure CDN endpoint before DNS points at it, it satisfies every gate this rule has, and it is the loudest source here by a wide margin."71  - "Cache and origin troubleshooting runbooks that reproduce a routing problem by requesting the edge hostname directly while forcing the customer hostname in the Host header, so support can compare what the edge serves against what the origin serves."72  - "Multi-tenant platform integration tests that select a tenant or a staging backend by Host header while connecting to the shared CDN front end that all tenants sit behind."73  - "Synthetic monitoring and health-check agents built on curl that probe each edge property by its CDN hostname with the service hostname pinned in the Host header, running on a fixed schedule from a monitoring host."74level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((((FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/busybox") and (ProcessCommandLine contains "-H Host:" or ProcessCommandLine contains "-HHost:" or ProcessCommandLine contains "--header=Host:")) and ProcessCommandLine contains "https://") and (ProcessCommandLine contains "cloudfront.net" or ProcessCommandLine contains "azureedge.net" or ProcessCommandLine contains "fastly.net" or ProcessCommandLine contains "akamaihd.net"))

Splunk · SPL

Run this as a search.

index=* ((((Image="*/curl" OR Image="*/wget" OR Image="*/busybox") AND (CommandLine="*-H Host:*" OR CommandLine="*-HHost:*" OR CommandLine="*--header=Host:*")) AND CommandLine="*https://*") AND (CommandLine="*cloudfront.net*" OR CommandLine="*azureedge.net*" OR CommandLine="*fastly.net*" OR CommandLine="*akamaihd.net*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((((TO_LOWER(process.executable) LIKE "*/curl" OR TO_LOWER(process.executable) LIKE "*/wget" OR TO_LOWER(process.executable) LIKE "*/busybox") AND (TO_LOWER(process.command_line) LIKE "*-h host:*" OR TO_LOWER(process.command_line) LIKE "*-hhost:*" OR TO_LOWER(process.command_line) LIKE "*--header=host:*")) AND TO_LOWER(process.command_line) LIKE "*https://*") AND (TO_LOWER(process.command_line) LIKE "*cloudfront.net*" OR TO_LOWER(process.command_line) LIKE "*azureedge.net*" OR TO_LOWER(process.command_line) LIKE "*fastly.net*" OR TO_LOWER(process.command_line) LIKE "*akamaihd.net*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/curl$|/wget$|/busybox$)</field>    <field name="CommandLine" type="pcre2">(?i)(-H Host:|-HHost:|--header=Host:)</field>    <field name="CommandLine" type="pcre2">(?i)https://</field>    <field name="CommandLine" type="pcre2">(?i)(cloudfront\.net|azureedge\.net|fastly\.net|akamaihd\.net)</field>    <description>HTTP client fronting a CDN edge with an overridden Host header</description>    <mitre>      <id>T1090.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: reverse_shell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a4491efb-bb50-4bfd-85aa-d33e2bf6c0d2

ATT&CKT1090.004

T1090.004Domain Fronting

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1090.004, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add more specific Image paths or names to reduce false positives from legitimate system activity
Filter out known benign command lines or URLs that match the selection_cdn criteria
Consider adding additional conditions, such as a specific user or group, to narrow down the scope of the detection
Modify the selection_host_override to look for more specific or anomalous Host header overrides

Declared by the author

Pre-cutover verification of a CDN distribution, where an operator or a deployment script curls the distribution hostname over HTTPS and supplies the production hostname as a Host header because no CNAME exists yet. This is the documented way to test a CloudFront or Azure CDN endpoint before DNS points at it, it satisfies every gate this rule has, and it is the loudest source here by a wide margin.
Cache and origin troubleshooting runbooks that reproduce a routing problem by requesting the edge hostname directly while forcing the customer hostname in the Host header, so support can compare what the edge serves against what the origin serves.
Multi-tenant platform integration tests that select a tenant or a staging backend by Host header while connecting to the shared CDN front end that all tenants sit behind.
Synthetic monitoring and health-check agents built on curl that probe each edge property by its CDN hostname with the service hostname pinned in the Host header, running on a fixed schedule from a monitoring host.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects a potential reverse shell attack where an HTTP client, such as curl, wget, or busybox, is used to front a Content Delivery Network (CDN) edge with an overridden Host header, indicating a possible attempt to bypass security controls or hide malicious activity. The key factor that separates this from normal activity is the combination of using a specific HTTP client, overriding the Host header, and targeting a CDN edge over HTTPS.

02 · Telemetry you need

Log source: process creation logs from Linux systems
Specific fields: Image, CommandLine
Audit setting: process creation logging must be enabled, which may be off by default on some systems

03 · How the logic works

The rule works by selecting process creation events where the image matches known HTTP clients (curl, wget, or busybox), and the command line contains specific indicators of a potential reverse shell attack: an overridden Host header (-H Host:, -HHost:, or --header=Host:), a TLS connection (https://), and a CDN edge (cloudfront.net, azureedge.net, fastly.net, or akamaihd.net). The condition requires all these selections to be true, indicating a high likelihood of malicious activity.

04 · Common false positives

Legitimate use of curl or wget by system administrators or developers to test or interact with CDNs
Automated scripts or tools that use busybox or other HTTP clients to fetch resources from CDNs
Web scraping or crawling tools that override the Host header for legitimate purposes

05 · Detection maturity

tier_1: The rule as written provides a basic detection capability, but may generate false positives due to its broad criteria.
tier_2: With tuning and filtering, the rule can become more accurate and effective, reducing noise and improving detection of actual reverse shell attacks.
tier_3: Correlating this rule with other signals, such as network traffic or system calls, can provide a more comprehensive understanding of the attack and improve the overall detection capability.

Related detections1 nearby

curl or wget overrides the Host header to impersonate a cloud service

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/a4491efb-bb50-4bfd-85aa-d33e2bf6c0d2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

HTTP client fronting a CDN edge with an overridden Host header

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it