Detection Engineering
Detection Invariants and Adversary-Controlled Features
Learn to distinguish necessary behavior from details an adversary can cheaply change, without pretending that any invariant is universal or permanently observable.