Why Attackers (and Defenders) Use It

Same technique, different intent. Analysts must recognize the mechanics,

not just the label.