A detection that matches a filename catches exactly one attacker: the one who did not rename the file.
This is the single most useful idea in the discipline. Some of the things you can detect are trivial for an attacker to change, and some are expensive. A hash changes by recompiling. A filename changes by typing. A domain changes by spending a dollar. But the sequence of actions someone takes after they get in — enumerate the network, dump credentials, move sideways, stage data, leave — is how they know how to work. Changing that means learning a new job.
So write detections at the expensive end, and treat the cheap end as disposable.
A concrete example. "Alert on a file named psexec.exe" is worthless; renaming it defeats you. "Alert when a service is created remotely on a host by an account that has never done that before" catches the technique regardless of what the binary is called, because creating a service remotely is what the tool does.
Now the part that decides whether any of this survives contact with a real week: every detection needs a false-positive story before it goes live.
The failure mode is not a missed alert. It is forty alerts a day that are all the backup agent, which trains the person on duty to close the queue without reading it, and three weeks later a real one arrives and gets closed at the same speed. A noisy detection is worse than no detection, because it costs attention you did not have and it teaches a bad reflex.
So for each rule, write down three things next to it. What normal thing might also do this. How often you expect it to fire. What the person receiving it should actually do. If you cannot answer the third, the rule is not finished — it is a notification with no purpose.
Start narrow and widen. A rule that only watches your four domain administrators will fire rarely and mean something every time. The same rule across every account will drown you on day one and be switched off by day three.
And tune by exclusion, not by deletion. When the backup agent trips a rule, exclude that account on that host for that action, and write down why. Deleting the rule loses the detection; a documented exclusion keeps it and tells the next person what you already worked out.