A Suricata analyst wants to write a rule that detects outbound HTTP connections where the Host header contains an IP address instead of a domain name. Why is this significant from a security perspective?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because legitimate HTTP traffic uses domain names in the Host header; malware connecting directly to C2 IP addresses skips DNS resolution (avoiding DNS-based logging and filtering), making IP-based Host headers a useful indicator of malicious HTTP traffic. B is wrong because HTTP Host headers with IPs are about HTTP/1.1 requests; SSL certificate errors occur during TLS handshake and are a separate consideration.
Full explanation below image
Full Explanation
A is correct because legitimate HTTP traffic uses domain names in the Host header; malware connecting directly to C2 IP addresses skips DNS resolution (avoiding DNS-based logging and filtering), making IP-based Host headers a useful indicator of malicious HTTP traffic. B is wrong because HTTP Host headers with IPs are about HTTP/1.1 requests; SSL certificate errors occur during TLS handshake and are a separate consideration. C is wrong because while uncommon, IP addresses can technically appear in Host headers; Suricata can parse them correctly. D is wrong because plain HTTP is unencrypted regardless of whether the Host header contains a domain or IP address.