Comment by magnoliakobus

Both the protocol tunneling activity and the binary would likely be flagged by most enterprise security software.