CISA’s report makes it clear that these techniques are valuable, especially when attackers use legitimate credentials and tools that make malicious activity harder to distinguish from normal behavior. If you want to actually implement these ideas, I wrote the book Intrusion Detection Honeypots specifically around this philosophy. I also have a hands-on course that walks through designing and deploying IDHs in real environments.