feat(detection-pipeline): harden chain1 correlation under degraded telemetry

[Bobby-Okafor]

Summary

This change validates and hardens the PowerShell EncodedCommand -> C2 beacon correlation workflow against degraded real-world telemetry.

Problem

A replay of the chain1_c2_beacon validation dataset successfully produced correlation chains but failed to generate detections.

Validation output showed:

• Correlation chains built successfully
• Detections fired: 0

Root Cause

Investigation identified inconsistent ProcessGuid values between Sysmon EID 1 process creation telemetry and Sysmon EID 3 network connection telemetry.

Example:

EID1:
{282c4705-ea32-6a0e-2412-00000005c00}

EID3:
{282c4705-448c-6a0c-d909-00000005c00}

The original detection logic required strict ProcessGuid equality, causing valid attack chains to be missed despite successful correlation.

Engineering Changes

• Improved normalization handling
• Hardened correlation chain construction
• Added degraded telemetry tolerance
• Updated detection logic to leverage chain context when authoritative joins fail
• Preserved high-confidence correlation paths while reducing dependency on a single field

Validation Dataset

telemetry/raw/chain1_c2_beacon

Validation Results

Before:

• Correlation chains: 3
• Detections fired: 0

After:

• Correlation chains: 3
• Detections fired: 1

ATT&CK Mapping

• T1059.001 PowerShell
• T1071.001 Web Protocols

Lessons Learned

Detection validation against replayed telemetry exposed a real correlation failure mode that synthetic testing did not reveal.

Detection logic must tolerate degraded telemetry while maintaining sufficient context to preserve detection fidelity.