A Suricata analyst wants to write a rule that detects outbound HTTP connections where the Host header contains an IP address instead of a domain name. Why is this significant from a security perspective?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're watching for IP addresses in HTTP Host headers because malware often hits C2 servers directly and skips DNS resolution. That dodges DNS logging and filtering, so an IP-based Host header is a useful red flag for suspicious outbound HTTP traffic.
Full Explanation
The option saying all legitimate HTTP connections use domain names in the Host header, while malware uses IP addresses to contact C2 servers directly and bypass DNS-based controls, is correct. Malware that connects straight to a C2 IP address can skip DNS resolution, avoiding DNS logging and filtering, so an IP-based Host header is a useful indicator of suspicious HTTP traffic. The option about SSL certificate errors is wrong because the Host header belongs to HTTP/1.1 request handling, while SSL certificate errors occur during the TLS handshake and are a separate consideration. The option saying browsers never send IP addresses and any occurrence is a Suricata parsing error is wrong because IP addresses can technically appear in Host headers, though uncommon, and Suricata can parse them correctly. The option saying encrypted HTTP bypasses content filters is wrong because plain HTTP is unencrypted regardless of whether the Host header contains a domain or IP address.