A regular expression (regex) is a sequence of characters that defines a search pattern for matching text. A regex can be used to detect the presence of a malicious piece of software communicating with its command-and-control server by matching the indicators of compromise (IOC) in the network traffic.
In this case, the systems administrator should use the regex Host: [a-z]*.malicious.com to determine if any of the company hosts are compromised, while reducing false positives, because this regex would:
* Match the Host header in the HTTP request, which specifies the domain name of the command-and-control server.
* Allow any subdomain under the malicious.com domain, by using the character class [a-z]*, which matches zero or more lowercase letters.
* Escape the dot character in the domain name, by using the backslash , which prevents it from being interpreted as a wildcard that matches any character.
* Not match any other parts of the IOC that could change, such as the URL path, the User-Agent header, or the HTTP method.