Criteria for escalation
Four canonical categories
✅ Confirmed malicious activity
Validated IOCs reliably linked to attacker behavior. Triage moves into containment posture.
💎 High impact / business-critical
Confirmed malicious or unauthorized activity touching systems essential to operations, regulated data, or revenue. Escalates before the evidence picture is complete.
↔️ Lateral movement or exfiltration
Advanced compromise stage. Containment timing becomes urgent because blast radius is growing.
🌐 Ongoing or widespread campaign
Multiple hosts, users, or sectors. Coordinated activity demanding organization-level response.
The four categories as a run-at-every-phase checklist, with sub-checks and the decision rule: ⬇ escalation-checklist.md, also printed on the one-page reference. The checklist rephrases this page’s signs as checkable observations; the categories and the decision rule are identical.
The break-glass rule: a confirmed criterion escalates from any phase
The seven phases are a thinking order, not a waiting queue. The moment any canonical criterion is confirmed, in Subject, in Uncover, anywhere, the case escalates immediately: page the IR lead, start the warm handoff, and let the remaining phases complete under IR’s clock, in parallel with containment. Do not finish the loop first. An investigation that is still revealing new lateral movement is not “not ready to escalate”; it is the definition of a case IR should already own, with triage continuing as scoping support. Suspicion is different: an unconfirmed signal refines Scope and re-runs the loop. Confirmation breaks the glass.
Confirmed malicious activity
Escalation is warranted when definitive evidence ties the event to attacker behavior. Confirmed malicious activity reflects intentional use of tactics, techniques, and procedures aligned with known Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. actors or campaigns.
Verified malicious infrastructure
IP addresses or domains associated with known command-and-control servers, phishing sites, or other malicious infrastructure documented in threat-intelligence sources.
Malware indicators
File hashes matching malware or unauthorized tools documented in threat-intelligence databases, with verified malicious functionality.
Exploitation evidence
Execution of attacker tools or exploits consistent with known malware families or attacker profiles, showing intentional compromise.
MITRE ATT&CK correlation
Use of techniques mapped to MITRE ATT&CK tactics such as privilege escalation, persistence, or defense impairment. The framework gives the activity structured context.
Correlation over single signals
When evaluating potential malicious activity, security analysts must correlate multiple data points to confirm true positives. Internal threat-hunting results combined with external Threat Intelligence Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice. indicating active targeting of the organization provide strong validation. Behavioral patterns consistent with attacker playbooks or distinct phases of the intrusion kill chain suggest coordinated malicious intent rather than isolated anomalies.
High impact / business-critical systems affected
When confirmed malicious or unauthorized activity touches systems essential to operations, Regulatory Compliance Adherence to laws, regulations, and standards governing data protection, privacy, and security requirements for specific industries or data types. , or Sensitive Data Information that is confidential, proprietary, or regulated, such as personal data, financial information, or intellectual property. protection, the case escalates before the evidence picture is complete: nobody waits to quantify blast radius on a crown jewel. Business-critical systems support mission-critical services, store regulated data, or perform functions whose disruption could cause substantial operational, financial, or reputational harm.
What this criterion is not: asset value by itself. An unvalidated alert on a domain controller has not confirmed anything, and paging IR on asset profile alone floods the escalation path with weak cases until nobody answers the page. What the asset profile does do, deterministically, is tighten the clock under the Risk framework’s override rules: a validated-but-unresolved high-impact case floors at P2 when the uncertainty comes from missing evidence, and a benign-leaning one continues at P3 on the tightened high-impact clock, never the standard 24 hours. Same facts, same action, whichever page the analyst read first.
🏭 Production environments
Systems directly impacting revenue generation or customer experience. Compromise can result in service degradation, financial losses, and customer dissatisfaction.
📋 Regulated data repositories
Databases containing PII, PHI, or payment card data. Heightened scrutiny due to compliance violations and mandatory breach-reporting under GDPR and HIPAA, card-brand rules for payment data, and SEC/state disclosure regimes.
☁️ Cloud infrastructure
Cloud environments hosting critical workloads, particularly those with privileged access or extensive connections to organizational data.
🔑 Identity and access systems
Identity providers (IdPs), authentication services, VPNs. Compromise here could impact the entire organization’s secure-access infrastructure, enabling widespread unauthorized access.
Cross-functional coordination required
Business-critical systems often require cross-functional coordination involving IT operations, compliance, and executive stakeholders. Escalating is what brings those owners into the case while notification clocks can still be met; a triage analyst cannot engage them alone.
Lateral movement or data exfiltration detected
The detection of Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. or Data Exfiltration The unauthorized transfer of data from a computer or network to an external location or system. signifies an advanced stage of compromise. Attackers leveraging lateral movement expand control beyond the initially Compromised Host A system under attacker control, often used for lateral movement, staging malware, or maintaining persistence within a network. . Data exfiltration indicates intent to steal information with regulatory and business consequences.
Stages of compromise
Initial compromise
Attacker gains foothold on a single system. Triage usually starts here.
Internal reconnaissance
Discovery of additional network resources. Often the earliest expansion signal.
Lateral movement
Expansion to additional systems. Blast radius now exceeds triage capacity.
Data exfiltration
Extraction of valuable information. Regulatory clocks may already be running.
Lateral-movement signs that demand immediate escalation
- Unauthorized Access Access to a system, network, or resource without proper authorization or permission. to multiple endpoints or servers beyond the initial compromise.
- Credential Dumping Extracting credentials (hashes, tokens, tickets) from a compromised system's memory or files. (T1003) followed by credential-use techniques like Pass-the-Hash An attack technique that allows an attacker to authenticate to a remote server/service using the underlying NTLM or LM hash of a user's password instead of the password itself. (T1550.002) or Pass-the-Ticket Kerberos analog of pass-the-hash. The attacker presents a stolen TGT (Ticket Granting Ticket) or TGS (Ticket Granting Service ticket) to authenticate as that identity against any service in the realm, without ever needing the user's password. Often paired with Mimikatz extraction of LSASS memory. MITRE T1550.003. (T1550.003). Dumping extracts the hash or Kerberos ticket; pass-the-hash/ticket is the subsequent use of the stolen material to authenticate as that identity. Both stages on the same case is a strong escalation signal.
- Internal reconnaissance via PowerShell A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes. , WMI, or PsExec to gather network topology.
- Suspicious lateral connections at unusual hours or from unexpected source systems.
- Tunneling mechanisms designed to hide communication between compromised hosts.
- Large data transfers to external destinations, especially with encryption or Obfuscation Techniques used to make code, commands, or data difficult to understand or detect, used both by attackers and legitimately for IP protection. .
Escalation enables Network Segmentation The division of a network into smaller, isolated segments to improve security and reduce the attack surface. , Credential Whatever the system accepts as proof of identity: a password, an API key, an OAuth token, a Kerberos ticket, an NTLM hash. Credentials are the highest-value loot in most intrusions; their theft is usually the pivot point. rotation, and Endpoint A device that initiates network connections and runs user-facing software: laptop, desktop, server, phone, tablet. Endpoints are where most adversary tradecraft eventually shows up, which is why EDR exists. isolation. The presence of these techniques demonstrates attacker sophistication and intent that extends beyond opportunistic exploitation to targeted data theft or persistent access.
Ongoing or widespread attack campaign
Attack campaigns requiring rapid escalation indicate sustained adversary presence or coordinated efforts targeting multiple assets. Early recognition allows organizational-level response and deployment of enhanced defensive measures.
Related alerts across systems
Multiple alerts showing similar IOCs or attack techniques across different systems or locations within a short timeframe suggest coordination by a single threat actor or group.
Coordinated attack patterns
Distributed phishing campaigns, simultaneous ransomware deployment attempts, or waves of brute force suggest orchestrated activity using sophisticated infrastructure designed for scale.
Evasive techniques
Polymorphic malware or rapidly evolving techniques suggest adversaries actively modifying their approach to bypass controls, a sign the detections that caught this alert will not keep catching the next one.
Threat intelligence context
External intel feeds correlating local detections with known campaigns targeting your industry or region. A local alert that matches an active campaign is rarely the only affected system.
Campaign-level escalation enables system-wide defense
Escalating events with these characteristics enables organization-wide defensive measures, coordinated response activities, and potential engagement with industry partners or law enforcement. Timely elevation allows security leadership to mobilize resources, implement strategic countermeasures, and collaborate with external entities when necessary.
Priority levels: P1–P4
The triage matrix in Risk framework outputs a default action; the bands below give those actions their names. P1–P4 is a priority scale, how fast someone must act, not a severity taxonomy. Scoring happens in Risk with the RATM rubric; this table only translates the matrix cell into a clock. Map the labels onto your organization’s own paging tiers, but keep the semantics.
Key Takeaway
Escalation criteria are the SOC’s pre-committed answer to “should I escalate?” Four canonical categories cover most cases: confirmed malicious activity, high impact, lateral movement / Exfiltration The unauthorized transfer of data from a system or network, often as part of a data breach or espionage operation. , and ongoing campaign. A criterion confirmed at any phase escalates from that phase; that is the break-glass rule. Use the criteria as the default; override only with documented reasoning grounded in the same evidence Risk evaluated.