Signature-based detection

Logic that looks for known patterns and is highly effective when attackers reuse recognizable tools, exploit sequences, or network artifacts.