Analysis
Finding DNS tunnelling in a 4 GB capture without a signature
Entropy, subdomain cardinality and query-rate shape — three statistics that find a covert channel faster than any rule matching a known tool.
T1048.003T1071.004
Archive
Research
Incident teardowns, detection engineering, reverse engineering and network forensics. Filtered to tunnelling.