That they of detection in AV is really rare, because AV (rightfully) optimizes to an extreme for low false positives. Instead you just have slightly more comple

That they of detection in AV is really rare, because AV (rightfully) optimizes to an extreme for low false positives. Instead you just have slightly more complex signatures that look at syscall ordering or whatever. It's not nearly as powerful as it sounds.