Everyone's posting their allow-lists for agent egress. Fine. But how are you catching the stuff you *don't* know about? The exfil that isn't going to your defined logging or update endpoints.

IP and domain blocklists are reactive. I'm talking about behavioral signatures. Things that might indicate an agent compromised and trying to phone home somewhere new, or a rogue process using its channel.

Example: a sudden burst of DNS queries for random subdomains from a host that normally does five an hour. Or an outbound connection on an odd port from the agent process itself, when it only uses 443.

I've seen some half-baked ideas about matching packet size regularity or TLS SNI patterns, but they're easy to bypass. What actually works? Has anyone built a real-time filter that's caught something? Don't just say "anomaly detection." Be specific. What thresholds? What fields are you inspecting?