Protocol tunneling encodes malicious traffic inside permitted protocols — DNS tunneling (data in DNS queries), HTTPS tunneling (C2 in normal HTTPS), ICMP tunneling (data in ping packets).
DNS tunneling is popular because DNS is almost always allowed outbound. DNS monitoring and filtering prevents DNS tunneling. HTTPS tunneling requires SSL inspection to detect. High query frequency or unusual DNS response sizes indicate DNS tunneling.