Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate inspection
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add mukul975/Anthropic-Cybersecurity-Skills/hunting-for-domain-fronting-c2-trafficCompatible with
Supported agents
| name | hunting-for-domain-fronting-c2-traffic |
| description | Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate inspection |
| domain | cybersecurity |
| subdomain | threat-hunting |
| tags | - domain-fronting - c2-detection - tls-inspection - proxy-logs - pyopenssl - threat-hunting - network-security |
| version | '1.0' |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | - Application Protocol Command Analysis - Network Isolation - Network Traffic Analysis - Client-server Payload Profiling - Network Traffic Community Deviation |
| nist_csf | - DE.CM-01 - DE.AE-02 - DE.AE-07 - ID.RA-05 |
Domain fronting (MITRE ATT&CK T1090.004) is a technique where attackers use different domain names in the TLS SNI field and the HTTP Host header to disguise C2 traffic behind legitimate CDN-hosted domains. This skill detects domain fronting by parsing proxy/web gateway logs for SNI-Host header mismatches, analyzing TLS certificates for CDN provider identification, flagging connections where the SNI points to a high-reputation domain but the Host header targets an attacker-controlled domain, and correlating with known CDN provider IP ranges.
JSON report containing detected domain fronting indicators with SNI-Host pairs, certificate details, CDN provider identification, confidence scores, and MITRE ATT&CK technique mapping.
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionhunting-for-domain-fronting-c2-trafficExecute the skills CLI command in your project's root directory to begin installation:
epx add mukul975/Anthropic-Cybersecurity-Skills/hunting-for-domain-fronting-c2-trafficFetches hunting-for-domain-fronting-c2-traffic from mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/hunting-for-domain-fronting-c2-traffic
Restart Cursor to activate hunting-for-domain-fronting-c2-traffic. Access via /hunting-for-domain-fronting-c2-trafficin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
detecting-insider-threat-behaviors
mukul975/Anthropic-Cybersecurity-Skills · detecting-insider-threat-behaviors · same repo
hardening-windows-endpoint-with-cis-benchmark
mukul975/Anthropic-Cybersecurity-Skills · hardening-windows-endpoint-with-cis-benchmark · same repo
performing-cryptographic-audit-of-application
mukul975/Anthropic-Cybersecurity-Skills · performing-cryptographic-audit-of-application · same repo
generating-threat-intelligence-reports
mukul975/Anthropic-Cybersecurity-Skills · generating-threat-intelligence-reports · same repo
performing-network-traffic-analysis-with-tshark
mukul975/Anthropic-Cybersecurity-Skills · performing-network-traffic-analysis-with-tshark · same repo
detecting-rdp-brute-force-attacks
mukul975/Anthropic-Cybersecurity-Skills · detecting-rdp-brute-force-attacks · same repo
hunting-for-domain-fronting-c2-traffic is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
Registry listing for hunting-for-domain-fronting-c2-traffic matched our evaluation — installs cleanly and behaves as described in the markdown.
hunting-for-domain-fronting-c2-traffic reduced setup friction for our internal harness; good balance of opinion and flexibility.
Keeps context tight: hunting-for-domain-fronting-c2-traffic is the kind of skill you can hand to a new teammate without a long onboarding doc.
We added hunting-for-domain-fronting-c2-traffic from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
I recommend hunting-for-domain-fronting-c2-traffic for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Solid pick for teams standardizing on skills: hunting-for-domain-fronting-c2-traffic is focused, and the summary matches what you get after install.
Useful defaults in hunting-for-domain-fronting-c2-traffic — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
Useful defaults in hunting-for-domain-fronting-c2-traffic — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
hunting-for-domain-fronting-c2-traffic has been reliable in day-to-day use. Documentation quality is above average for community skills.
showing 1-10 of 66