{"version":"1.0","provider_name":"NewEvol","provider_url":"https:\/\/www.newevol.io\/resources","author_name":"Krunal Medapara","author_url":"https:\/\/www.newevol.io\/resources\/author\/krunal-medapara\/","title":"Why Rule-Based SIEM Detection Misses New and Unknown Threats - NewEvol","type":"rich","width":600,"height":338,"html":"<blockquote class=\"wp-embedded-content\" data-secret=\"Og4znoywSQ\"><a href=\"https:\/\/www.newevol.io\/resources\/blog\/rule-based-siem-limitations\/\">Why Rule-Based SIEM Detection Misses New and Unknown Threats<\/a><\/blockquote><iframe sandbox=\"allow-scripts\" security=\"restricted\" src=\"https:\/\/www.newevol.io\/resources\/blog\/rule-based-siem-limitations\/embed\/#?secret=Og4znoywSQ\" width=\"600\" height=\"338\" title=\"&#8220;Why Rule-Based SIEM Detection Misses New and Unknown Threats&#8221; &#8212; NewEvol\" data-secret=\"Og4znoywSQ\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" class=\"wp-embedded-content\"><\/iframe><script>\n\/*! This file is auto-generated *\/\n!function(d,l){\"use strict\";l.querySelector&&d.addEventListener&&\"undefined\"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!\/[^a-zA-Z0-9]\/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret=\"'+t.secret+'\"]'),o=l.querySelectorAll('blockquote[data-secret=\"'+t.secret+'\"]'),c=new RegExp(\"^https?:$\",\"i\"),i=0;i<o.length;i++)o[i].style.display=\"none\";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute(\"style\"),\"height\"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):\"link\"===t.message&&(r=new URL(s.getAttribute(\"src\")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener(\"message\",d.wp.receiveEmbedMessage,!1),l.addEventListener(\"DOMContentLoaded\",function(){for(var e,t,s=l.querySelectorAll(\"iframe.wp-embedded-content\"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute(\"data-secret\"))||(t=Math.random().toString(36).substring(2,12),e.src+=\"#?secret=\"+t,e.setAttribute(\"data-secret\",t)),e.contentWindow.postMessage({message:\"ready\",secret:t},\"*\")},!1)))}(window,document);\n\/\/# sourceURL=https:\/\/www.newevol.io\/resources\/wp-includes\/js\/wp-embed.min.js\n<\/script>\n","thumbnail_url":"https:\/\/www.newevol.io\/resources\/wp-content\/uploads\/2026\/10\/980-1.jpg","thumbnail_width":1920,"thumbnail_height":900,"description":"An attacker signs in with a valid account. Using PowerShell and a remote management tool already approved on the network, they explore file servers and copy data out in small batches. The SIEM collects every log. The login succeeded, the tools are legitimate, and no single transfer crosses a threshold. No rule fires. The SIEM&hellip; Continue reading Untitled"}