In this section
TH1.12 Escalation Protocols and IR Handoff
Speed matters at escalation
When a hunt discovers a compromise, every hour between discovery and containment is an hour the attacker continues to operate. The analysis step (TH1.4) already established that high-confidence findings (3+ correlated enrichment dimensions) warrant immediate escalation. This subsection addresses the mechanics.
The escalation package
The IR analyst or SOC lead who receives the escalation needs enough information to take immediate action without re-running the hunt. The package:
// Generate the evidence summary for the escalation package
// Adapt entity and time window from your hunt finding
let compromisedUser = "j.morrison@northgateeng.com";
let incidentWindow = 7d;
union
(SigninLogs | where TimeGenerated > ago(incidentWindow)
| where UserPrincipalName == compromisedUser
| where IPAddress == "203.0.113.47"
| project TimeGenerated, Source = "SigninLogs",
Detail = strcat("Sign-in from ", IPAddress,
" (", tostring(LocationDetails.countryOrRegion), ")")
),
(AuditLogs | where TimeGenerated > ago(incidentWindow)
| where InitiatedBy.user.userPrincipalName == compromisedUser
| where OperationName has_any ("registered security",
"InboxRule", "Consent to application")
| project TimeGenerated, Source = "AuditLogs",
Detail = OperationName),
(EmailEvents | where TimeGenerated > ago(incidentWindow)
| where RecipientEmailAddress == compromisedUser
| where ThreatTypes has "Phish"
| project TimeGenerated, Source = "EmailEvents",
Detail = strcat("Phishing: ", Subject))
| sort by TimeGenerated asc
// This produces the chronological evidence timeline
// for the escalation packageTry it yourself
Exercise: Draft an escalation package
Using the finding from TH1.3–TH1.5 exercises (or a hypothetical finding if your hunt produced no true positives), draft the complete escalation package: finding summary, evidence table (run the evidence timeline query adapted for your finding), recommended containment actions, and hunt context.
Show the package to a colleague or your SOC lead. Ask: "If you received this at 2 AM, do you have enough information to start investigating?" If the answer is no, identify what is missing and add it.
The hunt-to-IR handoff
When a hunt discovers active compromise, the transition from hunting to incident response must be immediate and structured. The hunter documents: what was found, which entities are affected, the estimated timeline of the activity, and the current confidence level. This document becomes the IR team's starting point — they should not need to re-run the hunter's queries to understand the scope. At NE, Rachel's protocol requires the hunter to produce a one-page handoff document before the IR team takes over: finding summary, affected entities (users, devices, IPs), timeline (first evidence to most recent), data sources queried, and recommended immediate containment actions.
The queries developed during this exercise become reusable templates in your personal hunting library. Parameterise the hardcoded values (user names, IP addresses, time windows) and add a header comment explaining the hypothesis each query tests. A mature hunting program maintains 50-100 parameterised query templates that any team member can execute — reducing the per-hunt preparation time from hours to minutes and ensuring consistent methodology across analysts.
The handoff document should use a standardised template that the IR team is already familiar with — ideally the same template used for alert escalation from the SOC. Consistency in format reduces the cognitive overhead for the receiving team: they know where to find the affected entities, the timeline, and the recommended actions without searching through a free-form narrative. At NE, the hunt handoff template mirrors the incident handoff template with one addition: the hunt hypothesis and the evidence that confirmed it.
The myth: Take time to fully document the finding before escalating. False escalations damage credibility.
The reality: Documentation happens in parallel with — not before — escalation. A high-confidence finding (3+ correlated dimensions) has sufficient evidence for immediate escalation. Waiting to write a polished report while the attacker continues operating wastes the dwell time compression that justified the hunt in the first place. Escalate with the evidence you have. Document the full hunt record after containment is initiated. The escalation package (finding summary, evidence, containment recommendation) takes 10 minutes to assemble. The full hunt record takes 20 minutes after the hunt concludes. Do not confuse the two.
Extend this protocol
If your organization has a formal incident management process with defined severity levels and escalation matrices, integrate hunt escalations into that process. A high-confidence hunt finding should create a Sentinel incident (manually or through a dedicated automation rule for hunt escalations) with the appropriate severity and assignment. This ensures the finding enters the same workflow as detection-triggered incidents — with the same SLAs, the same triage process, and the same documentation requirements. TH14 covers the integration of hunting with SOC workflows in detail.
References Used in This Subsection
- Course cross-references: TH1.4 (confidence model for escalation threshold), TH1.5 (conclusion — confirmed outcome), TH0.6 (hunting → IR handoff point 6)
Detection depth: NE-specific implementation
This detection rule addresses a technique that directly threatens NE's operational environment. The implementation accounts for NE's specific infrastructure characteristics:
Telemetry source: The primary data table for this detection ingests approximately 0.5-3.2 GB/day depending on the activity volume. At NE's scale (810 users, 865 devices, 42 servers), the event volume generates a stable baseline that statistical detection methods (percentile analysis from DE9.4) can reliably characterize. Deviations from this baseline represent either environmental changes (new applications, infrastructure modifications) or attacker activity.
Your privilege escalation hunt finds that a service account was added to the Global Administrator role 4 months ago by an IT administrator. The IT admin says it was needed for a migration project that has since completed. What do you recommend?
Remove the Global Administrator role immediately and document the finding. A service account with permanent Global Admin — even if legitimately assigned — is a standing privilege escalation risk. The migration project completed 4 months ago, but the elevated permission persists. The hunt finding: 'Stale privilege assignment — service account [name] retains Global Administrator from completed migration project. Recommend: remove role, implement PIM just-in-time activation for any future temporary elevation, and add a calendar reminder for privilege review at project completion.' This finding improves NE's security posture — it is exactly the type of security debt that hunts are designed to identify.
You understand the detection gap and the hunt cycle.
TH0 showed you what detection rules fundamentally cannot catch. TH1 gave you the hypothesis-driven methodology that closes that gap. Now you run the hunts.
- 10 complete hunt campaigns — from hypothesis through KQL execution through finding disposition, each campaign based on a real TTP
- 70 production hunt queries — every one mapped to MITRE ATT&CK and tested against realistic telemetry
- Advanced KQL for hunting — UEBA composite risk scoring, retroactive IOC sweeps, and hunt management metrics
- Hypothesis-Driven Hunt Toolkit lab pack — 30 days of realistic M365 and endpoint telemetry with multiple attack patterns seeded in
- TH16 — Scaling hunts across a team — the operating model for a production hunt program