Misbehaving Modalities: Detecting Tools, Not Techniques

**Executive Summary:** This article introduces and explains the "Execution Modality" concept for reasoning about how malicious behaviors are executed (not just what they do), advocates detecting closer to the operating system source-of-truth (e.g., kernel ETW and call stacks), describes Elastic's modality-based PowerShell detections and example rules, and evaluates detection robustness using the Summiting the Pyramid analytic score.