Why SIEM Rules Fail and How to Fix Them: Insights from 160 Million Attack Simulations