Detection patterns are hunting pivots — tune to your telemetry schema. Network patterns are the most valuable exfil indicators. Simulation commands use attacker.example.com as placeholder for blue team testing only. Dataset: tools.json.