When I worked on the Dragon intrusion detection system in the late 90s, there was a signature race. For every exploit that existed, the NIDS vendors were expected to write a detection rule. As attacks became more stealthy over the past two decades, the industry began to rely on indicators of compromise and hunting outliers. Certain types of threat intelligence provides massive amounts of indicators of compromise. By searching for and preventing access to this massive amount of command and control infrastructure discovered by other researchers, you can detect and prevent attackers from using it on your networks.