npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Domain fronting (MITRE ATT&CK T1090.004) is a technique where attackers use different domain names in the TLS SNI field and the HTTP Host header to disguise C2 traffic behind legitimate CDN-hosted domains. This skill detects domain fronting by parsing proxy/web gateway logs for SNI-Host header mismatches, analyzing TLS certificates for CDN provider identification, flagging connections where the...
Detects domain fronting C2 traffic in proxy logs via SNI-Host mismatches and TLS cert inspection with pyOpenSSL. Flags CDN-disguised threats for SOC threat hunting.
Detects domain fronting C2 traffic by analyzing proxy logs for SNI and HTTP Host mismatches, using pyOpenSSL for TLS certificate inspection and CDN provider identification. Useful for threat hunting.
Detects C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints. Useful for threat hunting and incident response on suspicious connections.
Share bugs, ideas, or general feedback.
Domain fronting (MITRE ATT&CK T1090.004) is a technique where attackers use different domain names in the TLS SNI field and the HTTP Host header to disguise C2 traffic behind legitimate CDN-hosted domains. This skill detects domain fronting by parsing proxy/web gateway logs for SNI-Host header mismatches, analyzing TLS certificates for CDN provider identification, flagging connections where the SNI points to a high-reputation domain but the Host header targets an attacker-controlled domain, and correlating with known CDN provider IP ranges.
JSON report containing detected domain fronting indicators with SNI-Host pairs, certificate details, CDN provider identification, confidence scores, and MITRE ATT&CK technique mapping.