https://unit42.paloaltonetworks.com/detecting-dns-tunneling-campaigns/