SpecterOps interview question

Real scenario case for detecting an attack