SpecterOps Interview Question

Real scenario case for detecting an attack