"The kill chain matters, because detection is in part a timing problem. The later you detect, the worse things get."
Truer words I have not recently heard. This is a fantastic post about why C2detection should not be your first line of defense. #BlueTeam
https://medium.com/breakout-time/the-c2-trap-3acabbc7a04f