A SOC analyst notices that a workstation is sending a steady stream of traffic to an external host on TCP port 443. On inspection, the payloads do not follow the TLS handshake structure — instead, an interactive remote shell session appears to be encapsulated inside the connection. The corporate firewall permits outbound 443 to any destination. Which evasion technique is the attacker most likely using?