Build a Durable Detection

Jisr Bank confirmed an intrusion: a phishing document spawned encoded PowerShell that dropped and persisted an implant. You have the incident's process telemetry and the available fields. Design a detection that catches this behavior durably — not one tied to the specific hash or IP that the attacker will rotate.

What you will be able to do

Choose durable behavioral fields over volatile artifacts.
Structure boolean conditions to match the behavior precisely.
Map the detection to an ATT&CK technique.

Detection EngineeringWindows SecurityLog AnalysisT1059.001 — PowerShellT1053.005 — Scheduled Task