Tracks the state of active network connections.
[ Malicious Payload ] │ ┌────────┴────────┐ ▼ ▼ [Obfuscation] [Fragmentation] (Base64/Hex) (Tiny Packets) │ │ └────────┬────────┘ ▼ [ Firewalls / IDS ] <-- Fails to match known signatures │ ▼ [ Victim Machine ] <-- Reassembles and executes payload Obfuscation and Encoding