SUSA-PST-072 / fictional WS-042 offline training collection

All task definitions, event excerpts and the payload stand in are fictional.
The four extensionless files in source/Tasks contain UTF-16 Task Scheduler XML.
Parse them with the real ParseScheduledTasksXML.ps1. Do not import, register or
run these tasks. Parsing XML does not execute a task's command.

The supporting CSV is a readable synthetic event excerpt, not an EVTX file or
output from ParseScheduledTasksXML. Event 200 records action launch, not script
success. The payload stand in contains comments only and is not a real alert
payload. It cannot support a claim about harmful behavior.

In a real incident, collect task files from Windows/System32/Tasks and preserve
metadata, host identity and original logs. Check a lead against original XML,
Task Scheduler Operational EVTX and process/PowerShell evidence. No TaskCache,
process telemetry, PowerShell log or completion event is supplied in this pack.

RegistrationInfo.Date and Author are values inside XML, not proven facts about
creation or a human actor. TaskFile_LastModifiedTime describes the extracted
working file; ZIP extraction timestamps are not original endpoint timestamps.

manifest.csv lists the SHA-256 of all six supplied evidence files. A matching
hash checks file contents against this training manifest, not authenticity of
an incident acquisition. Keep the downloaded ZIP as the source package.
