Why Default SIEM Rules Aren’t Enough

(And How Attackers Quietly Slip Through)