{'created': '2020-03-14T23:29:19.581Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may take advantage of routing schemes in Content '
                'Delivery Networks (CDNs) and other services which host '
                'multiple domains to obfuscate the intended destination of '
                'HTTPS traffic or traffic tunneled through HTTPS. (Citation: '
                'Fifield Blocking Resistent Communication through domain '
                'fronting 2015) Domain fronting involves using different '
                'domain names in the SNI field of the TLS header and the Host '
                'field of the HTTP header. If both domains are served from the '
                'same CDN, then the CDN may route to the address specified in '
                'the HTTP header after unwrapping the TLS header. A variation '
                'of the the technique, "domainless" fronting, utilizes a SNI '
                'field that is left blank; this may allow the fronting to work '
                'even when the CDN attempts to validate that the SNI and HTTP '
                'Host fields match (if the blank SNI fields are ignored).\n'
                '\n'
                'For example, if domain-x and domain-y are customers of the '
                'same CDN, it is possible to place domain-x in the TLS header '
                'and domain-y in the HTTP header. Traffic will appear to be '
                'going to domain-x, however the CDN may route it to domain-y.',
 'external_references': [{'external_id': 'T1090.004',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1090/004'},
                         {'description': 'David Fifield, Chang Lan, Rod Hynes, '
                                         'Percy Wegmann, and Vern Paxson. '
                                         '(2015). Blocking-resistant '
                                         'communication through domain '
                                         'fronting. Retrieved November 20, '
                                         '2017.',
                          'source_name': 'Fifield Blocking Resistent '
                                         'Communication through domain '
                                         'fronting 2015',
                          'url': 'http://www.icir.org/vern/papers/meek-PETS-2015.pdf'}],
 'id': 'attack-pattern--ca9d3402-ada3-484d-876a-d717bd6e05f2',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'command-and-control'}],
 'modified': '2025-10-24T17:49:23.135Z',
 'name': 'Domain Fronting',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Matt Kelly, @breakersall'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Linux', 'macOS', 'Windows', 'ESXi'],
 'x_mitre_version': '1.2'}