Like any other detection system you will always have determined adversaries that put in the work to bypass it.
But that doesn't mean you shouldn't still try to block the much larger number of less sophisticated/resourced adversaries that are using OOTB libraries and low-effort setups.
Like any other detection system you will always have determined adversaries that put in the work to bypass it.
But that doesn't mean you shouldn't still try to block the much larger number of less sophisticated/resourced adversaries that are using OOTB libraries and low-effort setups.