Close or escalate: the criteria

About 12 min read

The E rule

Risk scores the case and recommends a move; the Escalation decision makes the call and records it. One rule decides it, and the closure check below is how a documented close meets the same evidence standard as an escalation:

Four canonical categories

The four categories also ship as a run-at-every-phase checklist, with sub-checks and the decision rule, and are printed on the one-page reference. The checklist rephrases this page’s signs as checkable observations; where the wording differs, this page and the Risk framework are the reference.

# Escalation-criteria checklist

<!-- ASSURED Methodology by Timothy Zilber, © Block, Inc., CC BY 4.0
     (https://creativecommons.org/licenses/by/4.0/). Reuse and adapt freely
     with attribution; note any changes you make.
     Template version: 2.0
     ASSURED escalation criteria
     (https://assured-methodology.vercel.app/docs/escalation/criteria).
     Run this list at every phase, not only at the Escalation decision. Any
     CONFIRMED box escalates the case immediately under the escalation
     tripwire: the case is P1 whatever the matrix cell; page the incident
     response (IR) lead, preserve what containment would destroy, start the
     warm handoff, and let the remaining phases complete under IR's clock.
     Suspicion (unconfirmed) refines Scope and re-runs the loop instead.
     Where this list and the criteria page differ in wording, the criteria
     page is the reference. -->

- Case ID:
- Checked by, in which phase, at (UTC):

Mark each box [S] suspected or [C] confirmed. Confirmed means the claim
behind the box reaches High on the shared confidence rubric: direct evidence
from a source trusted for that kind of claim, corroborated by an independent
source, with the leading benign alternative tested and ruled out. A single
threat-intelligence match, an ATT&CK mapping, or asset value alone never
confirms.

## 1. Confirmed malicious activity not fully contained by a control

- [ ] Verified malicious infrastructure: IPs or domains tied to known C2 (command and control), phishing, or attacker infrastructure in threat-intelligence sources, corroborated by host or identity telemetry showing what the connection did (a listing alone is a lead)
- [ ] Malware indicators: file hashes matching documented malware or unauthorized tools with verified malicious functionality, plus a second source showing the file ran or was staged to run
- [ ] Exploitation evidence: attacker tools or exploits executed, consistent with known malware families or attacker profiles
- [ ] ATT&CK-mapped behavior outside any sanctioned change, in tactics such as privilege escalation, persistence, or defense impairment (ATT&CK v19), corroborated by an independent source (benign administration maps to ATT&CK routinely; the mapping names the behavior, it does not prove malice)

Contained by a control: malicious activity a control verifiably blocked or
quarantined, with no execution and no follow-on evidence (no persistence,
credential exposure, or spread), is not criterion 1. Verify the control
held, record the case at P3 or P4 on its matrix cell, and propose it as a
pattern-entry candidate. It does not page IR. Any execution or follow-on
activity means it was not fully contained, and the tripwire applies.

## 2. High impact / business-critical systems affected

Confirmed here means confirmed malicious or unauthorized activity touching one
of these asset classes; the asset profile alone does not confirm the criterion.

- [ ] Production systems directly supporting revenue or customer experience
- [ ] Regulated data repositories: personally identifiable information (PII), protected health information (PHI), or payment card data (mandatory breach-notification clocks may apply)
- [ ] Cloud infrastructure hosting critical workloads, especially with privileged access or broad connections to organizational data
- [ ] Identity and access infrastructure: domain controllers, identity providers (IdPs), public key infrastructure (PKI), secrets management, VPN and remote-access gateways
- [ ] Security and recovery infrastructure: endpoint detection and response (EDR), security information and event management (SIEM), backup consoles (tampering blinds detection or removes the ability to recover)
- [ ] Systems whose disruption causes substantial operational, financial, or reputational harm

Once confirmed, escalate before the evidence picture is complete; nobody waits
to quantify blast radius on a crown jewel. An unconfirmed case on these assets
instead runs the Risk framework's override rules: when evidence is missing,
likelihood reads Medium (unknown is not Low) and the case is P2, escalate
within 4 hours; when the evidence was examined and leans benign, it continues
at P3 on the tightened high-impact clock (re-score within hours, not 24).

## 3. Lateral movement or exfiltration

- [ ] Attacker-driven expansion: the activity has reached a second host, account, or service beyond the original subject, and the benign explanations for the hop (sanctioned administration, automation) have been ruled out
- [ ] Data staging observed: unusual or password-protected archives, collection folders, large internal transfers
- [ ] Outbound transfer to external or anomalous destinations, measured against the host's own baseline, especially destinations the organization does not sanction
- [ ] Credential dumping followed by credential use, or credential use that crosses a trust boundary (new segment, new tenant, new privilege tier)

Blast radius is growing; containment timing is now urgent.

## 4. Ongoing or widespread campaign

- [ ] Multiple hosts or users showing the same or related activity
- [ ] The same lure, infrastructure, or artifact appearing across teams or business units
- [ ] A password spray that produced at least one successful authentication, or that targets the organization specifically (custom username lists, your naming convention)
- [ ] Variant churn: the same behavior from samples with different hashes on multiple hosts within days
- [ ] External intelligence reporting an active campaign targeting the organization or sector, matched to a local artifact (an indicator, lure, or technique seen here), not the report alone
- [ ] Coordinated timing that suggests an operator, not an opportunistic one-off

## Decision

Escalate if a criterion is confirmed or the matrix places the case at P1 or
P2. At P3, keep working to the named re-score trigger, then close or
escalate. Close at P4. Record the cell either way.

- Any box CONFIRMED, in any phase: the case is P1 whatever the cell; escalate now under the escalation tripwire.
- Boxes suspected but not confirmed: record the suspicion, refine Scope, and continue the loop with the criterion named as an open question.
- No box confirmed: the matrix cell decides. P1 or P2 → escalate (P2 within 4 hours, with a complete handoff packet). P3 → keep working to the named re-score trigger, then close or escalate. P4 → documented close, a first-class verdict.
- Operational routes (no criterion required): capacity (a single analyst who cannot both watch the queue and work the case). Name the route in the handoff.
- Insider route: if the subject is an employee or contractor and the activity suggests intentional harm, restrict case visibility, do not notify the subject's manager or team, and route the case through the insider-risk process (legal, then HR). Analysts record observable technical activity only; HR-held context reaches the case only through the insider-risk route, never as analyst-collected notes.
- [ ] Regulatory flags and candidate awareness timestamps recorded; owners engaged.
- Cell recorded (impact / likelihood, with confidence beside it: high / medium / low), and the reasoning:

On escalation, preserve before you contain: volatile evidence and the
artifacts a containment action would destroy come first. Pre-authorized
actions are reversible only; credential resets and OAuth grant revocations
need IR or owner approval unless the protocol lists them for the scenario.

### Closure check (before a documented close)

- [ ] No escalation criterion confirmed, or open as a suspicion
- [ ] The cell allows it: P4, or a P3 whose named re-score trigger came back clean
- [ ] No persistence or credential access observed in the evidence examined
- [ ] The case's own alternatives checked clean
- [ ] Gaps bounded: each named, with the reopen triggers written down

### Priority clocks

Default clocks from the Risk triage matrix; adopters tune them to their
staffing and paging model.

| Band | Acknowledge | Decision |
| --- | --- | --- |
| P1 | Page immediately; no-acknowledgment fallback at 15 minutes | Escalate immediately with a warm handoff; the packet completes in parallel |
| P2 | Within 15 minutes | Escalate within 4 hours, with a complete packet |
| P3 | Queue | Investigate to closure or re-score within 24 hours on a named trigger (High/Low runs the tightened high-impact clock: within hours) |
| P4 | Queue SLA | Documented close within the queue SLA |

De-escalation is legitimate: a priority moves down with a named reason and
the same stakeholder notification the upgrade got.

The clock that matters is the time from the first confirmed criterion to the page, not the time from the alert to a finished packet. A P1 set hours after its first criterion was confirmed is a late P1, however good the packet is, and further confirmations do not restart the clock: the tripwire fires on the first one. The finance-team example shows what those hours cost, and the triage-quality measures track the interval for every escalation.

Grouped alerts are one case. When several alerts share an entity and a time window, a campaign indicator, or a vendor incident ID, the criteria are checked against the case as a whole, and its riskiest member sets the depth level (see Correlated cases). A confirmed criterion on any member escalates the whole case.

Confirmed malicious activity not fully contained by a control

Escalation is warranted when evidence establishes intentional adversary behavior that no control has fully stopped. A match to a known threat Threat Any circumstance or event with the potential to harm the organization's operations, assets, or people (NIST, from CNSSI 4009). The actor behind it is the threat actor; the weakness it uses is a vulnerability. Classical risk models multiply threat, vulnerability, and impact. ASSURED's RATM does not multiply. It scores threat actor intent and exploitation & scope as their own dimensions and lets them inform likelihood, which never rises above what the evidence supports. Risk is then read from the impact-by-likelihood matrix. actor or campaign strengthens the case but is never required: novel tooling and unattributed operators are confirmed from behavior alone.

Every card above needs a second, independent source before it counts as confirmation. A threat-intelligence listing, a hash match, or an ATT&CK mapping tells the analyst where to look; host, identity, or network telemetry showing what actually happened is what confirms it. Internal hunt results combined with threat intelligence Threat Intelligence Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, implications, and actionable advice (after Gartner's widely cited definition). It is consumed at strategic, operational, and tactical levels. Before acting on it, weigh the source's reliability, the information's credibility (the Admiralty code is one common scheme), and its age. showing active targeting of the organization are strong corroboration, and behavior that follows several distinct stages of an intrusion points to coordinated intent rather than an isolated anomaly.

High impact / business-critical systems affected

When confirmed malicious or unauthorized activity touches systems essential to operations, regulatory compliance Regulatory Compliance Adherence to laws, regulations, and standards governing data protection, privacy, and security requirements for specific industries or data types. In triage, compliance obligations are why Scope checks the regulatory boundary early: they decide which notification clocks and preservation duties attach. , or sensitive data Sensitive Data Information whose exposure would cause harm: regulated data (personal data, PHI, cardholder data), credentials and keys, intellectual property, confidential business records. Regulated data plausibly accessed by the activity sets Scope's regulatory flags and is a Level 2 trigger; data merely in reach is a Scope flag. protection, the case escalates before the evidence picture is complete: nobody waits to quantify blast radius on a crown jewel. Business-critical systems support mission-critical services, store regulated data, or perform functions whose disruption could cause substantial operational, financial, or reputational harm.

What this criterion is not: asset value by itself. An unvalidated alert on a domain controller has not confirmed anything, and paging IR on asset profile alone floods the escalation path with weak cases until nobody answers the page. What the asset profile does do is tighten the clock under the Risk framework’s override rules:

Business-critical systems usually need IT operations, compliance, and executive owners in the response. Escalating is what brings those owners into the case while notification clocks can still be met; a triage analyst cannot engage them alone (see organizational stakeholders).

Lateral movement or data exfiltration detected

The detection of lateral movement Lateral Movement Moving from the initial foothold to other hosts, identities or tenants to find sensitive data or reach higher-value targets (ATT&CK tactic TA0008). It usually rides legitimate remote-access protocols (RDP, SMB, WinRM, SSH) with stolen credentials, or replays a stolen session into a cloud or SaaS tenant, so the signal is an account authenticating where it does not normally go. Each hop widens the blast radius, and confirmed lateral movement is an escalation criterion. or data exfiltration Data Exfiltration Deliberate and unauthorized transfer of data from a system or network to an external location (ATT&CK tactic TA0010). The covert routes, sometimes called data leakage channels, include the C2 channel itself, cloud storage, DNS tunneling and other protocol tunnels; each has its own entry on this page. signifies an advanced stage of compromise. Attackers leveraging lateral movement expand control beyond the initially compromised host Compromised Host A system under attacker control, often used for lateral movement, staging malware, or maintaining persistence within a network. . Data exfiltration indicates intent to steal information with regulatory and business consequences.

Stages of compromise

The four stages are a simplification. Credential access and privilege escalation are often the hinge between foothold and spread, which is why credential dumping leads the signs below.

Ongoing or widespread attack campaign

Attack campaigns requiring rapid escalation indicate sustained adversary presence or coordinated efforts targeting multiple assets. Early recognition allows organizational-level response and deployment of enhanced defensive measures.

Escalating a campaign is what makes organization-wide defense possible: a fleet-wide sweep, coordinated blocks, and, where it applies, engagement with industry partners or law enforcement. The NIST Cybersecurity Framework 2.0 outcomes that SP 800-61r3 builds on name two separate moves (RS.MA-04): escalation, which adds responders and time, and elevation, which brings in higher management. Campaigns usually need both, plus a sharing decision (an ISAC Information Sharing and Analysis Centers (ISACs) Sector-based organizations (FS-ISAC, Health-ISAC and others) through which members share threat intelligence, indicators and incident experience under agreed handling rules. For triage they are a source of early, sector-specific indicators; respect the TLP marking on what they share. or peers, under the Traffic Light Protocol, TLP 2.0) that legal owns.

Priority levels: P1 to P4

The priority bands have one home: the triage matrix maps each impact and likelihood cell to a band, and default clocks for each band gives each one its acknowledgment and decision clocks. P1 to P4 is a priority scale (how fast someone must act), not a severity taxonomy. Likelihood and confidence are separate: a High-likelihood case is confirmed only when the claim also reaches High confidence, which is why the Medium / High and Low / High cells still apply to probable-but-unconfirmed activity and to confirmed activity a control contained.

The same default clocks, with what each band means for the Escalation decision:

Map the band labels onto your organization’s own paging tiers; the meaning of each band is what has to survive the mapping.

Closing at triage: the closure check

Most triaged cases close. A documented close is a first-class verdict, not the absence of an escalation, and it passes a named check before it is recorded:

1. No escalation criterion confirmed, or open as a suspicion.
2. The cell allows it: P4, or a P3 whose named re-score trigger came back clean.
3. No persistence or credential access observed in the evidence examined.
4. The case’s own alternatives checked clean: the specific paths the evidence left open, such as the extension, MCP-server, and workspace-task inventory and the agent-command review in the Cursor example.
5. Gaps bounded: each named, with the reopen triggers written down.

The close records the verdict on both axes (detection: true positive, false positive (logic), or false positive (data); activity: malicious, policy violation, authorized (benign true positive), benign-confirmed, or undetermined), the priority and confidence, the five checks with the finding behind each, and the communication record. A benign true positive is a correct detection of authorized activity, never a false positive. A close produces no handoff packet, because nobody inherits the case; Documentation finalizes the record as the event report and runs the closure review on it.