In this case, we are accessing 1.2.3.4 as if it were host.corp.com. If we see a threat, we log this because PAN-OS resolves 1.2.3.4 to some other FQDN

( subtype eq spyware ) and ( ( name-of-threatid eq 'Suspicious TLS Evasion Found' ) or ( name-of-threatid eq 'Suspicious HTTP Evasion Found' ) ) and ( addr.dst in 1.2.3.4 ) and ( url eq 'host.corp.com/' )

Test using

curl --verbose --header 'Host: www.example.com' 'http://www.yandex.com'

The following will fetch www.sync.com even if “online storage” is blocked. It is classed as financial-services.

Evasion

curl --verbose --insecure --header 'Host: www.halifax.co.uk' 'https://www.sync.com' > index.html

No Evasion

curl --verbose --insecure --header 'Host: www.santander.com' 'https://www.sync.com/' > index.html

Filter results

( addr.src in 10.4.4.21 ) and ( addr.dst in 104.24.101.166 ) and ( url eq 'www.santander.com/' ) and ( url_category_list contains low-risk ) and ( url_category_list contains financial-services )

curl --verbose --insecure --header 'Host: www.halifax.co.uk' 'https://www.sync.com' > index.html

curl --verbose --insecure --header 'Host: www.santander.com' 'https://www.sync.com/' > index.html

sudo systemd-resolve --flush-caches

wget 'http://httpforever.com/'

( addr.src in 10.4.4.21 ) and ( addr.dst in 104.24.101.166 ) and ( url eq 'httpforever.com/' )   and ( url_category_list contains low-risk ) and ( url_category_list contains computer-and-internet-info )

show dns-proxy cache all

clear dns-proxy cache all

These work even if you do not have dns proxy setup as the firewall still looks up the DNS names.

HTTP evasion works (sometimes) but SSL evasion uses certificate information to check the domain (I think). I need to generate a fake website for Google and use a certificate trusted by the endpoint and firewall so I can see if this evasion then works. However, in the real world, getting a certificate for Google that the firewall trusts will be difficult. An untrusted chain can be blocked with SSL Decryption Profiles. The HTTP evasion only seemed to work at first when we did not query a CNAME record. The firewall cache have a FQDN CNAME for the original DNS query which can't be matched against and IP. If the DNS Cache TTL expires the query, then we can bypass prevention (Test this). HTTP evasion will always work with a random FQDN. However, URL filtering will always call this “high-risk,unknown”.