Detection rules should target attacker techniques, not tool names, to resist renaming

Many detection rules flag specific tool filenames, which becomes useless once an attacker simply renames the binary. The article argues for focusing on technique-level invariants, the behaviors an attacker cannot easily change without redesigning the attack. Examples include LSASS memory access with read rights from non-legitimate sources, WMI spawning command shells, pass-the-hash logon patterns, and Linux SUID escalation signatures. The author illustrates this with a Sigma rule for LSASS access, noting it was checked only for syntax and must still be tested against real data. The piece closes by previewing a discussion of why strong rules can still generate heavy false-positive volumes.