[op00to]

What if the traffic was masked - say certain "routine" DNS queries to kick off a request to get further commands to run? I wouldn't be worried about facile root kits, but higher quality attacks that are way harder to detect.