Thank you for the followup! A quick question: after reading over "Detecting and preventing the use of DNScat" on this page: http://tadek.pietraszek.org/project

Thank you for the followup! A quick question: after reading over "Detecting and preventing the use of DNScat" on this page: http://tadek.pietraszek.org/projects/DNScat/ http://tadek.pietraszek.org/projects/DNScat/ , it seems as if uncovering small amounts of data sent this way might be difficult. Here are the detection techniques mentioned: detecting unusual and malformed DNS packets (DNScat will evade this) detecting high number of unusual types of DNS queries (e.g. TXT) (DNScat will also evade this) Anomaly detection: DNS query and response length Anomaly detection: profiling the amount of traffic per client source IP address Are there any other detection methods?