SOC › Module 9 › Lesson 3
L3 Handoff
L2 to L3 handoff literacy — forensics package, scope, evidence index, open questions — on $HUNT_LAB escalation stub.
Visual · t30_l3_handoff
L3 handoff = named forensics transfer package. $HUNT_LAB. Original Cyberlium.
Opening
L3 needs a forensics-ready package — build the L2→L3 handoff from YOUR lab escalation stub, not a vague 'need deeper look.'
L3 handoff literacy: executive summary (three lines), severity and ticket link stub, PICERL stage and containment/eradication status, evidence index from Module 6-3, hunt findings and queries UTC, detection gaps from Module 9-2, recommended L3 scope (memory capture category, timeline expansion category — literacy not unauthorized imaging), open questions, analyst contact. Analyst builds handoff block from $HUNT_LAB escalate-yes scenario — without unauthorized prod L3 page, without attack repro in next steps, without omitting evidence chain. Cyberlium extends Topic 29 L2 handoff to L3 depth on practice rows. Refused: prod escalation without RoE, handoff with offensive cookbooks, empty forensics package. Lab row: L3 handoff template with ten required fields completed for one lab scenario.
1. L3 handoff fields
Summary, severity, PICERL status, evidence index, hunt findings, gaps, L3 scope, open questions, contact — nine literacy anchors.
Handoff extends Module 6 roles — L3/forensics pickup point.
Command guide
Try these commands — L3 handoff fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
L3 handoff — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/ MITRE — https://attack.mitre.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
python3 - <<'PY'
import os
lab = os.environ.get('HUNT_LAB', os.path.expanduser('~/cyberlium-lab/t30-hunt'))
path = os.path.join(lab, 'pir', 'l3-handoff-LAB-IR-001.md')
open(path, 'w').write('
'.join([
'# L3 Handoff — LAB-IR-001',
'## For L3 hunt lead',
' - Validated hypothesis: credential guess → execution → C2',
' - Open: any other hosts contacted 203.0.113.99?',
' - Open: svc_backup SMB lateral (LAB-IR-002) linked?',
'## Artifacts',
' - hunt/hunt-hypothesis.md, correlation-notes.md',
' - ir/ir-timeline-LAB-IR-001.md, containment-log-LAB-IR-001.md',
' - pir/detection-gaps-LAB-IR-001.md',
'## Detection tuning requests',
' - See hunt/tuning-notes-l2.txt + pir/detection-gaps',
'## Refusals: no Impacket/Mimikatz/Cobalt; lab telemetry only',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'L3|Artifacts|Refusals' "$HUNT_LAB/pir/l3-handoff-LAB-IR-001.md"
Primary tools to practice this lesson: grep, python3. Reference sites: L3 handoff (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); MITRE (https://attack.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender hygiene
Evidence index complete before L3 scope request — chain rows attached.
Next steps list defender forensics categories — not attack repro.
3. Refused
No unauthorized prod L3 escalation; no vague handoff without evidence index.
L3 handoff literacy supports tier ops — not on-call chaos.
4. What you ship: L3 handoff block template
Ten required fields + one completed lab escalation + NEVER vague handoff line.
5. What you record before the next lesson
L3 handoff block template path.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Page real employer L3 with empty notes as 'handoff practice.'
Right
L3 handoff block from $HUNT_LAB escalation stub. Next: PIR Lab.
Mission: L3 handoff block template
1) List ten handoff fields. 2) Complete block for one lab scenario. 3) Attach evidence index stub. 4) Write NEVER unauthorized prod L3 page line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “L3 scope — memory capture literacy stub?”
Knowledge Check
APPLY: L3 handoff includes:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized prod L3 page is lab.
True or False
Knowledge Check
APPLY: Evidence index before L3 scope:
Multiple choice