Agent Foskett Academy • SOC Analyst Academy • Module 7 • Lesson 65 • Incident Response: Containment, Evidence & Escalation

Lesson 65 — The Attack Was Still Active

The SOC had confirmed the compromise.

Evidence was being preserved.
Containment actions were being coordinated.

Then another event appeared.

And another.

The suspicious account touched a second device.
A new external connection appeared.
Another cloud action followed.

Agent Foskett looked at the timeline.

“We're not investigating what happened anymore. We're watching it happen.”

When malicious activity is still active, containment becomes a race against the attacker's next action.

Respond to the Active Attack Back to SOC Analyst Academy

Agent Foskett responding to an active cyber attack

The incident is still moving.

Recognise continuing attacker activity, shorten the decision cycle and contain the paths that can cause the next piece of harm.

✓ Confirm continuing activity

✓ Prioritise immediate risk

✓ Contain in parallel

✓ Verify attacker options shrink

Case briefing

INCIDENT: mia@contoso.com / FIN-WS-044 14:02 — Suspicious PowerShell confirmed 14:07 — External connection identified 14:12 — Credential-access evidence 14:18 — FIN-WS-044 isolation requested 14:21 — Same account appears on FIN-WS-061 14:25 — New cloud file access 14:29 — Suspicious external connection from FIN-WS-061 14:33 — Mailbox activity continues THIS IS NOT ONLY HISTORICAL EVIDENCE. THE ATTACK IS STILL ACTIVE. QUESTION: WHAT MUST THE SOC STOP FIRST?

Investigation objective

Recognise evidence that malicious activity is continuing, identify the attacker's remaining access paths and prioritise containment actions while investigation and scoping continue in parallel.

Investigator's rule

When the attack is active, every unanswered question does not have equal priority. First answer the questions that change what you must contain now.

Stage 1 — prove the incident is still moving

HISTORICAL INCIDENT: Malicious activity happened ↓ Activity stopped ↓ SOC reconstructs events ACTIVE INCIDENT: Malicious activity happened ↓ New malicious activity appears ↓ New entities appear ↓ Scope changes ↓ Attacker capability remains available THE RESPONSE TEMPO MUST CHANGE.

Use timestamps, not feelings

“The attacker is still active” should be supported by recent evidence: new process execution, connections, authentication, cloud actions, persistence or activity on additional entities.

Define what “active” means

Be specific. Is a malicious process still executing? Is the identity still producing cloud activity? Is a second endpoint now involved? The answer determines the containment priority.

Stage 2 — watch endpoint activity as it develops

1234567

DeviceProcessEvents
| where Timestamp > ago(1h)
| where DeviceName in~ ("FIN-WS-044", "FIN-WS-061")
| project Timestamp, DeviceName, AccountName,
          FileName, ProcessCommandLine,
          InitiatingProcessFileName
| order by Timestamp asc

Look for new execution after response begins

If suspicious execution continues on another endpoint after the first device is isolated, the incident scope has changed. The original device was not the attacker's only path.

Do not stare only at the first device

An active attacker may move faster than an analyst who keeps investigating the original endpoint. Scope indicators and identities across the environment while the detailed investigation continues.

Stage 3 — identify continuing network access

1234567

DeviceNetworkEvents
| where Timestamp > ago(1h)
| where DeviceName in~ ("FIN-WS-044", "FIN-WS-061")
| project Timestamp, DeviceName,
          InitiatingProcessFileName,
          RemoteIP, RemotePort, RemoteUrl, ActionType
| order by Timestamp asc

Ask what capability remains

A continuing connection may represent command-and-control, data access or ordinary traffic. Correlate it with the initiating process, timing and other evidence before deciding what it means.

Block the path, not merely the indicator

Blocking one destination may reduce risk, but an attacker with valid credentials or another compromised endpoint may simply use another route. Containment should address the access path revealed by the evidence.

Stage 4 — check whether identity activity continues

123456

CloudAppEvents
| where Timestamp > ago(1h)
| where AccountId =~ "mia@contoso.com"
| project Timestamp, AccountId, Application,
          ActionType, IPAddress, UserAgent
| order by Timestamp asc

Endpoint containment may leave cloud access alive

If cloud activity continues after a device action, investigate sessions, credentials, applications and other devices rather than assuming the endpoint action failed.

Multiple access paths can coexist

An attacker may have endpoint execution, stolen credentials and cloud persistence at the same time. The SOC may need coordinated containment across several control planes.

Stage 5 — prioritise by potential next harm

Observed activity	Immediate concern
New suspicious process execution	Further execution, payloads or persistence.
Credential-access behaviour	Additional identities may become compromised.
Activity on another endpoint	Lateral movement and expanding scope.
Privileged account activity	Security-control changes and broad tenant impact.
Sensitive file access	Potential exposure or exfiltration.
Mailbox manipulation	Persistence, fraud, impersonation or concealment.

Ask: what can happen next?

During an active incident, the best next action often comes from identifying the attacker's most dangerous remaining capability rather than finishing the most interesting investigative thread.

Impact and probability both matter

A low-probability but catastrophic action may demand urgent protection, while a high-frequency low-impact event may be less important. Use organisational response priorities and incident severity criteria.

Stage 6 — shorten the decision loop

NORMAL INVESTIGATION LOOP: Collect → Analyse → Pivot → Document → Decide ACTIVE-INCIDENT LOOP: OBSERVE ↓ ASSESS IMMEDIATE RISK ↓ CONTAIN ↓ VERIFY ↓ RESCOPE ↓ REPEAT INVESTIGATION CONTINUES. BUT RESPONSE CANNOT WAIT FOR THE FINAL REPORT.

Do not wait for perfect attribution

You may not know who the attacker is, exactly how initial access occurred or the full impact yet. Those unknowns do not prevent proportionate containment when ongoing malicious activity is supported by evidence.

Containment decisions still need discipline

Urgency does not mean improvisation. Use approved playbooks, defined authority and coordinated response actions, particularly for critical systems and privileged identities.

Stage 7 — contain in parallel

ENDPOINT TEAM: Contain affected devices IDENTITY TEAM: Contain affected identities / sessions MESSAGING TEAM: Review mailbox persistence CLOUD TEAM: Restrict malicious cloud access NETWORK TEAM: Apply approved network controls INCIDENT LEAD: Coordinate priorities and decisions SOC: Keep the evidence timeline moving ONE INCIDENT. MULTIPLE RESPONSE ACTIONS. ONE SHARED PICTURE.

Parallel response beats serial response

If the evidence supports several active access paths, waiting for one team to finish before another begins may give the attacker unnecessary time. Coordinate actions so containment closes paths together where appropriate.

Coordination prevents self-inflicted confusion

Every response action changes telemetry. Record who is doing what and when so analysts can distinguish attacker behaviour from defender activity.

Stage 8 — preserve evidence without protecting the attacker

WE STILL NEED EVIDENCE. BUT ASK: Will waiting allow lateral movement? Will waiting expose more data? Will waiting permit privilege escalation? Will waiting allow persistence? Will waiting let the attacker destroy evidence? IF YES: PRESERVE THE CRITICAL EVIDENCE YOU CAN SAFELY COLLECT... THEN CONTAIN. DO NOT KEEP AN ATTACKER ACTIVE JUST TO MAKE THE TIMELINE PRETTIER.

Evidence collection has a risk budget

The more dangerous the continuing activity, the less time responders can reasonably spend collecting optional evidence before containment. Preserve material evidence and document unavoidable gaps.

Watching an attacker requires exceptional justification

Do not casually delay containment merely to observe additional behaviour. Any deliberate monitoring of continuing malicious activity should follow explicit organisational authority, risk acceptance and specialist procedures.

Stage 9 — record the live response timeline

14:18 — Isolation requested for FIN-WS-044 14:21 — Same identity observed on FIN-WS-061 14:25 — Sensitive cloud access continues 14:29 — Suspicious connection from FIN-WS-061 14:31 — FIN-WS-061 containment approved 14:34 — Identity containment expanded 14:37 — Mailbox persistence reviewed 14:41 — No new endpoint execution observed 14:46 — No new suspicious cloud activity observed 14:52 — Scope reassessment begins ATTACKER ACTION DEFENDER ACTION ATTACKER RESPONSE CONTAINMENT EFFECT THAT IS HOW YOU PROVE THE INCIDENT IS CHANGING.

Record decision timestamps precisely

During a fast-moving incident, five minutes can matter. Precise timestamps help establish whether suspicious activity occurred before, during or after a containment action.

Keep one shared operational picture

Teams should work from a common incident timeline so that scope, actions, owners, evidence and unresolved risks do not fragment across separate conversations.

Stage 10 — verify attacker capability is shrinking

AFTER CONTAINMENT: Any new process execution? NO Any new affected endpoints? NO Any suspicious cloud activity? NO Any mailbox changes? NO Any new authentication events? REVIEWING Any new persistence? NOT OBSERVED Any privileged activity? NOT OBSERVED GOOD. BUT: "NO NEW ACTIVITY" DOES NOT YET MEAN "INCIDENT CLOSED." IT MEANS THE RESPONSE MAY BE GAINING CONTROL.

Silence is evidence — cautiously

A sustained absence of previously observed malicious activity after containment supports the conclusion that attacker options have been reduced. It does not prove eradication or complete scope.

Move from emergency containment to reassessment

Once active harm appears to have stopped, return to broader scoping, persistence review, impact analysis, evidence preservation and recovery planning.

Example active-incident update

STATUS: ACTIVE INCIDENT — CONTAINMENT IN PROGRESS CONFIRMED: Suspicious execution on FIN-WS-044. Credential-access evidence observed. Same identity subsequently appeared on FIN-WS-061. Cloud and mailbox activity continued during response. ACTIONS: FIN-WS-044 isolated. FIN-WS-061 containment initiated. Identity containment expanded. Mailbox persistence review underway. CURRENT OBSERVATION: No new suspicious endpoint execution or cloud activity observed since latest containment actions. UNRESOLVED: Initial access remains undetermined. Full affected-identity scope still under review. Persistence review not complete. NEXT: Continue monitoring for renewed activity. Complete environment-wide scoping. Verify containment across endpoint, identity, messaging and cloud evidence.

Lesson 65 key takeaways

Recent malicious events can prove that an incident is still active.
Define exactly what activity is continuing rather than using vague labels.
An active incident requires a faster observe-assess-contain-verify cycle.
Prioritise questions that change immediate containment decisions.
Do not focus only on the first compromised endpoint when scope is expanding.
Endpoint, identity, cloud and messaging access paths may remain active simultaneously.
Prioritise containment according to the attacker's potential next harm.
Investigation and containment should often proceed in parallel.
Record defender actions because they change the evidence timeline.
Do not delay necessary containment merely to collect optional evidence.
Verify that attacker capability is shrinking after response actions.
The absence of new activity supports containment but does not prove the incident is over.

Module 7 — Incident Response: Containment, Evidence & Escalation

Lesson 65 forced the SOC to respond while the attacker was still moving. Lesson 66 introduces the coordination problem that follows when identity, endpoint, messaging, cloud and business teams all become part of the same incident.

Next: Lesson 66 — The Incident Crossed Multiple Teams

Continue your SOC Analyst training

Module 3 focuses on identity incidents, authentication, MFA, privilege, sessions and application access.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 7: Incident Response: Containment, Evidence & Escalation

Move from investigation into coordinated containment, evidence preservation, scoping, escalation and recovery.

← Previous lesson

Lesson 64 — What Evidence Must We Preserve? Identify telemetry and artefacts that matter before remediation.

✅ Current lesson

Lesson 65 — The Attack Was Still Active Prioritise containment when malicious activity continues.

Next lesson →

Lesson 66 — The Incident Crossed Multiple Teams Coordinate identity, endpoint, messaging, cloud and business stakeholders.

How should a SOC respond when a cyber attack is still active?

Lesson 65 of the Agent Foskett SOC Analyst Academy teaches analysts how to recognise continuing malicious activity, prioritise immediate containment and coordinate response while an incident is still developing.

Active incident response with Microsoft Defender XDR

Learn how to use endpoint, network and cloud evidence to identify continuing attacker activity, track expanding scope, shorten the response decision cycle and verify whether containment is reducing attacker capability.