Closing the Loop: From Hunt to Detection
What is it?
Closing the loop is what makes a hunt count. Finding evil is the middle of the job, not the end. A finished hunt has scoped the finding (how far does it reach), turned any durable, repeatable malicious behaviour into a new detection so it is caught automatically next time, escalated a live intrusion into incident response, and documented the hypothesis and result — including a negative result, which proves coverage and narrows the next search.
Why it matters
A hunt whose knowledge evaporates is a hunt you will have to run again — the same ground re-covered forever. Closing the loop is what compounds a team's capability: every hunt either creates a durable detection (so a human never has to hunt that technique again) or documents coverage (so the next hunt starts from a smaller unknown). Without it, hunting is heroic effort with no lasting return.
Where you see it
The loop lives in the hand-offs: a confirmed repeatable behaviour goes to detection engineering (Module 7) as a new rule; a live intrusion goes to incident response (Module 9) as an escalation; the hypothesis, queries and outcome go into a hunt record or backlog so the team's coverage is visible and negative results are not re-run blindly.
What normal looks like
A well-closed hunt ends with concrete outputs: a scope (which hosts/accounts are affected), a new detection for any repeatable behaviour, an escalation if the activity is live, and a written record of the hypothesis and result. A negative hunt still ends with a record: 'searched X across the estate, found none, coverage confirmed'.
What suspicious looks like
A hunt that stops at 'found something bad' and moves on has wasted most of its value: nothing was scoped, no detection was created so the same technique will slip through next week, and nothing was documented so the knowledge dies with the analyst's memory. Equally broken is discarding a negative hunt as a failure — throwing away proof of coverage.
How analysts investigate
When a hunt finds a lead, scope it first (pivot the estate to see who else is affected), then decide the hand-offs: if the behaviour is repeatable, write a detection; if the activity is live, escalate to incident response; always document the hypothesis, the query, and the outcome. On a negative hunt, record the coverage. The hunt is done only when its knowledge is captured somewhere durable.
Common beginner mistakes
- Stopping at 'found evil' without scoping, without a detection, and without documentation.
- Not turning a repeatable finding into a detection, so the same technique must be hunted again.
- Discarding a negative hunt as worthless instead of recording the coverage it proved.
What you will be able to do
- Scope a hunt finding across the estate before acting.
- Turn a repeatable finding into a new detection and escalate a live one.
- Document every hunt, including a negative result, as coverage.
Finding the mshta execution felt like the win, but it is only the middle. If you stop there, next month someone hunts the exact same technique from scratch. Closing the loop is what turns one analyst's find into the whole team's permanent capability: scope it, convert a repeatable behaviour into a detection, escalate anything live, and write it down — so the knowledge outlives the hunt.
THE HUNT LOOP
hypothesis --> hunt at scale --> found a lead?
^ | \
| yes| \ no
| v v
(next hunt starts scope --> live? --yes--> ESCALATE (M9)
from smaller unknown) | |
| | no
| v v
+---- document <-- new DETECTION (M7)Worked example — the hunt found evil. Now what?
Your hunt confirmed WINWORD spawning mshta.exe on one host, and it is still running. A colleague says 'nice find' and closes the ticket. Before reading on, decide: is the hunt done? The answer: no, barely half of it. First scope — pivot the estate to see if any other host shows the same pair; a single-host find and a twenty-host find are different incidents. The activity is live, so escalate it to incident response now (that is Module 9). The behaviour is repeatable, so hand it to detection engineering as a new rule (Module 7) — an Office app spawning a scripting host — so no one ever has to hunt it by hand again. Finally, document the hypothesis, the query and the result. Closing the ticket at 'nice find' throws away the scope, the detection and the record — most of the value.
Recap
- Finding evil is the middle of a hunt — scope, hand off, and document to finish it.
- A repeatable finding becomes a detection (M7); a live one escalates to IR (M9).
- A negative hunt still has value — document the coverage it proved.
Sign in to save your progress on the server.