The Red Queen’s Race: Arms Race Dynamics in Threat Detection

**Executive Summary:** This essay argues that detection rules primarily catch commodity attackers who haven't updated tooling, that rule longevity is driven by vendor ecosystem changes rather than attacker adaptation, and that detection engineering adds value by creating environment-specific, less-public rules; persistent techniques (e.g., LSASS dumping) survive due to environmental conditions like unprotected hosts and freely available tooling, not because defenders' detections are ineffective.