Hooking can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.