Evasion, Exclusion Clauses, and False Positives in Detection

This chapter explores the concept of exclusion clauses and the potential for adversaries to evade them, highlighting the importance of narrow exclusion clauses to prevent adversaries from hiding. It also discusses the implementation of least privilege and the trade-off between tuning and sensitivity/recall in detection.