diff --git a/docs/DETECTION_GUIDE.md b/docs/DETECTION_GUIDE.md
index a7c57c1..c9d4d6e 100644
--- a/docs/DETECTION_GUIDE.md
+++ b/docs/DETECTION_GUIDE.md
@@ -12,6 +12,15 @@ not mean the simulator performs the technique.
 
 ## Five correlated signals
 
+## Benign-lookalike Tuning Matrix
+
+| Synthetic Action | Common Benign Explanation | Useful Enrichment Fields | Analyst Verification Question | Why No Standalone Alert |
+| :--- | :--- | :--- | :--- | :--- |
+| Cross-process handle | Debuggers, endpoint agents, or administrative tools requesting access. | signer, path, user, integrity level | Is the source binary a signed administrative/security tool? | Too common in normal OS/software operations to alert on alone. |
+| Remote memory allocation | Valid inter-process communications or legitimate monitoring apps. | parentage, prevalence, acquisition quality | Does the targeting process regularly allocate memory in peer processes? | Creates high false-positive rates if flagged independently. |
+| Remote thread context write | Legitimate thread manipulation by OS utilities or crash reporting tools. | signer, path, parentage | Is this execution part of an expected application framework task? | Context switching and thread writes happen natively in many frameworks. |
+| Remote thread execution | System diagnostics, profilers, or routine sub-routine execution. | user, path, prevalence | Was the target thread spawned by an authenticated system service? | Generating alerts here without context swamps analysts with noise. |
+| Unbacked memory execution | Dynamic JIT compilers or runtime script environments. | acquisition quality, integrity level, signer | Is the target process running a JIT engine (e.g., V8, .NET)? | JIT engines naturally execute unbacked memory blocks during standard runtime. |
 ### 1. Cross-process handle
 
 One fictional process requests access to a different fictional process. This is