CROSS-SIGNAL ENCODED POWERSHELL DETECTION LAB

Purpose
This original portfolio lab demonstrates how endpoint, identity, and network evidence can be correlated into a more defensible analyst review queue. It does not contain employer data, production field names, credentials, or production detection logic.

Analytic question
Did encoded PowerShell activity occur near a denied MFA event or an unusually large outbound transfer for the same user and host?

Included files
1. cross-signal-detection-lab.spl
2. synthetic-security-events.jsonl

ATT&CK mapping
Primary: T1059.001, PowerShell
Contextual signals: Valid Accounts and Exfiltration Over Web Service may be relevant only after analyst validation. They are not asserted from the synthetic events alone.

Expected result
The synthetic ada.lovelace activity should produce one high-severity result with all three signal domains present.
The grace.hopper activity should not produce a result because the PowerShell command is not encoded and the outbound transfer is below the lab threshold.

Validation procedure
1. Create or select a nonproduction Splunk index named portfolio_lab.
2. Ingest each JSON line and map the sourcetype field to the matching lab sourcetype.
3. Run cross-signal-detection-lab.spl across the event time range.
4. Confirm one result for ada.lovelace on wkstn-104.
5. Confirm signal_count equals 3 and severity equals high.
6. Confirm no result for grace.hopper.
7. Change the time window, transfer threshold, or required signal count to observe the effect on coverage.

False-positive considerations
- Administrative or deployment tooling that legitimately uses encoded PowerShell.
- Users denying MFA prompts caused by stale sessions or mobile notification fatigue.
- Approved large transfers to trusted services.
- Shared systems where user and host attribution are incomplete.

Production engineering considerations
- Replace generalized fields with normalized data-model fields.
- Maintain an allowlist for approved automation and trusted destinations.
- Preserve raw-event pivots for analyst validation.
- Measure alert precision, analyst disposition, and time to decision.
- Treat missing identity or host context as a data-quality issue rather than proof of safety.