A housing IT purple team reuses the same chain monthly but rotates hosts to avoid detector overfitting. What validity concern does host rotation address?

A housing IT purple team that reuses the same chain monthly but rotates hosts is addressing detector overfitting: preventing municipal detectors from learning a single host’s quirks instead of the general technique behaviors. Rotation keeps validation honest about ATT&CK techniques across the housing estate rather than rewarding a pet workstation’s fingerprint. Validity of continuous purple-team evidence depends on that generalization.

Why the other options fail by concept: Preventing municipal detectors from learning a single user’s habits instead of the general technique behaviors concerns user-level generalization across different identities, not testing detector generalization across different hosts. Preventing municipal detectors from learning a single host’s quirks instead of the full chain sequence patterns misstates the learning target, because host rotation validates general technique behaviors, not memorization of the full chain sequence patterns. Preventing municipal detectors from learning a single network’s quirks instead of the general technique behaviors concerns network-level generalization, not the validity threat of detector overfitting to one machine.

Exam caveat: rotating hosts does not remove the need for consistent technique parameters and authorization on each new target; wild variance in configuration can also confound results if uncontrolled. Operational check: maintain a monthly host rotation list of approved housing endpoints, run the same ATT&CK-mapped chain, compare detection rates across hosts, and investigate alerts that fire only on one familiar machine.