Yes that was my question: "why, do you want to do that when it sounds like a futile job to do?" If you have any kind of transformation (whatever trivial ROT or

Yes that was my question: "why, do you want to do that when it sounds like a futile job to do?" If you have any kind of transformation (whatever trivial ROT or XOR) of the payload then there is no chance of detecting it via pattern matching, and if you need a "program" to process it into its malicious form, then how does detection work? I understand you want to keep malicious payload from reaching endpoints in a form that would risk being consumed (malformed documents, images causing buffer overflows, executable and script files). But beyond that?