Most SOC detections are built for the attacker who trips a wire: a suspicious hash, a known IP, a noisy explo…