At shift end an unexplained 6 GB password-protected archive is still growing on a file server - what must your handover note carry?

## What makes this handover different Handing over a closed case is filing. Handing over an *open* one, where the working theory is that an adversary is currently active, is the hardest writing a SOC analyst does. The incoming analyst is in another region, reading cold at 22:00, and you will be unreachable. Everything you know that is not in the note is lost at the moment you log off - including the things you know but never articulated, which on a live case is most of what you know. The scenario: over four hours, a 6 GB password-protected archive has been assembled in a temporary directory on a file server, built from documents pulled from several shares. Nobody has claimed it. It is still growing. That is a **collection and staging** hypothesis, and staging is normally the step before exfiltration - which means the case has a clock on it that a closed case does not. ## The parts of the note **The hypothesis, stated as a hypothesis.** Not `suspicious archive on FS-07`, but `I believe an unauthorised actor is staging data on FS-07 for exfiltration; confidence moderate`. A named theory is what lets the next person work, because it tells them what evidence would matter. **Confidence, and what would change it.** Say what would raise it (the archive is copied to an external destination, the creating process has no legitimate parent, the account has no business on those shares) and what would collapse it (a change ticket for a migration, a scheduled job that produces exactly this pattern weekly, an admin who answers the phone and says it is theirs). This is the anti-anchoring device: a hypothesis handed over without its alternatives becomes a conclusion by the second shift, and the second analyst then spends the night confirming you. **The evidence, both ways.** The timeline in UTC: first file write, process creation records with the full command line and parent image, the account, the shares read, the byte growth. And the evidence *against*: no outbound transfer seen yet, the account has legitimately touched two of the four shares before, the host is a file server so bulk reads are not inherently odd. **What was already checked, with the queries and their scope.** So the incoming analyst spends their night on new ground, and knows which ground is uncovered. **What you deliberately did not do, and why.** This is the part inexperienced analysts omit and the part that most changes the next person's behaviour. Isolating the host would stop the staging - and would freeze your understanding at the same moment, ending visibility of what the actor does next and very likely telling them they are seen. Disabling the account has the same effect and may hit a real user. Whatever you chose, the note records the choice, the reason, and the condition under which it should be revisited. Otherwise the incoming analyst reads inaction as an oversight and either repeats your deliberation from scratch or reverses it blindly. **The time-critical watch, with the work pre-done.** Name the single event that changes everything - here, bytes leaving for an unfamiliar destination - and paste the query that would show it, with the cadence to run it. A live handover that requires the incoming analyst to invent the monitoring costs an hour you do not have. **Pre-authorised escalation.** State the threshold and the action: if condition X, declare an incident and page the IR lead; do not wait for the outgoing analyst. An open hypothesis that can only be escalated by the person who is asleep is not handed over at all. Name who has decision authority on the incoming shift. **What has been preserved and where.** The archive's path and hash, any process listing or memory capture taken, the exported logs - so the next person can reason about a copy rather than disturbing the live system, and so an artefact that the adversary may delete still exists. **Who has been told, and who has not.** The file server's owning team, if they were contacted, and in what terms - because if the estate itself may be compromised, the way you contact people is itself a decision the incoming analyst must not undo casually. ## Register Write for a stranger. No `as discussed`, no local acronyms, no unresolvable shorthand for hosts or teams, no reliance on a chat thread the incoming analyst is not in. Include the raw facts even where you also link to a console, because links expire and consoles are regionally partitioned. ## The outcome this is for The measure of a good handover note is that the *next* shift can escalate on it. A case that is declared an incident at 02:00 by someone who never spoke to the analyst who opened it is a functioning 24x7 SOC. A case that has been handed over three times with the note `still investigating, see previous` is a case that will be quietly closed on the fourth. If a live hypothesis survives two handovers without progress, the note should carry a decision point rather than another repetition: escalate it for a decision, or give it an owner and a deadline.