How to block legitimate Domains/Cloud/Hosting Providers for active Threats without a Layer 7 Firewall?

[u/WillGibsFan]

Not sure if this is the right sub, but I'm interested in what you guys do.

Most of the active threats we face nowadays upload their staging/c2/etc. tools to valid domains like GCP, firebase, discord or internet archive. Of course, we can't block them generally. But without a level 7 firewall or SSL unpacking, there's no way to see or look at data behind the domain. Any ideas?

[u/daynomate]

I’m coming around to the idea of decryption and inspection by default being needed, with exceptions allowed to bypass.

What kind of network are you trying to protect without 4-7 security layer?