AI Sigma Rule Logic Inversion — Detects Exactly the Wrong Condition

Intermediate SANS SEC598 cybersecurity drill: A Sigma rule for detecting encoded PowerShell was deployed last week. Your colleague ran it against a test