Agents can evade SIEM through API calls. No fingerprints, just "legit" API calls. Stealthier than any RAT.