covert channel communication artifact detector — free browser tool | fatcousin

home

drop sysmon network evtx csv or dns cache export · detect covert channel communication patterns · identify dns tunneling icmp tunneling and protocol abuse · surface data exfiltration hidden in legitimate protocol traffic · runs locally

network / dns artifacts

drop sysmon 3 · dns cache · firewall csv

or click

Select file

dns tunneling (>20 subdomains · entropy) · long hostnames · icmp anomalies · http beaconing · port knocking sequences

drop sysmon event 3 csv · dns cache export · firewall log