rule C2_Domain_Regex {
    meta:
        description = "Detects a pattern that looks like a C2 domain in a string."

    strings:
        // Regular expression (enclosed in forward slashes /)
        // Matches "http://" or "https://" followed by one or more letters/digits
        // and ending in ".com"
        $re_c2 = /h(tt)ps?:\/\/[a-z0-9]+\.com/

    condition:
        // Matches if the regular expression is found.
        $re_c2
}

test

test

chrome

Firefox

test 1-1 Chrome

test2 Firefox

test1 Firefox

Test4 Chrome