Great article but I am seeing more and more CNC connections to ligetimate web sites like AWS. If I were creating a CNC server I would direct it to one of the many public cloud web services and then encrypt the traffic from the infected host to the cloud. It seems the only way to detect this is to decrypt at the perimeter, which doesn't scale very well.