…Our context:

“We are not only energy blind, we are many of us consumption blind. We don’t emotionally feel that the average American consumes over 150 times the physical goods and service as the average human did two centuries ago. We take it for granted.

We’ve taken peace for granted. We’ve taken the international respect of our nation for granted. We’ve taken the six-continent-just-in-time supply chain for granted. We’ve taken the ecological function of the Holocene for granted…

@da_667 iodine and dnscat also have 20 years of signatures, known patterns, and detection logic baked into tooling. This doesn't.

But honestly that's beside the point. "Detectable" and "detected" are two very different sentences. iodine has been detectable for 20 years and I've watched it walk right out of enterprise networks that had no idea. Known technique != mature detection coverage in the median org.

SMB's are running Server 2008r2 with a Watchguard FW and a prayer. Mid-market is logging DNS at the firewall level and calling it done.

"Detectable in theory by a mature SOC" and "hard to detect in most real environments" are not mutually exclusive statements.