GhostWatch—an open-source covert channel detector for DNS tunneling, ICMP, HTTP C2 beaconing and timing channels

Haider Khan — Wed, 04 Mar 2026 13:57:01 +0000

I built GhostWatch to detect what enterprise tools like Darktrace and
Vectra Miss—covert channels hidden inside normal-looking DNS, ICMP,
and HTTP traffic.

It uses entropy analysis and behavioral detection instead of signatures.
so it catches real APT techniques like OilRig DNS tunneling and
SUNBURST-style beaconing.

GitHub: https://github.com/ShadowHunter89/ghostwatch

Would genuinely appreciate feedback from anyone who works in networks.
security or blue team. Still early stage.

DEV Community: Haider Khan

GhostWatch—an open-source covert channel detector for DNS tunneling, ICMP, HTTP C2 beaconing and timing channels