The detection method they used (Score 1)

... They detected the attack because they 've found a Ruby Script on ther nuclear weapons server. :-P