01 / INVESTIGATION MAP

Master hunt workflow

Start with a bounded scope, then let the evidence choose your next branch.

ATT&CK v19.2

Network scopeInternal Enterprise RFC 1918External Non-RFC 1918 IPv4

Internal ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, limited to enterprise hosts. External means outside all three ranges, including enterprise-owned public addresses. Classify by the session initiator, not return packets. Resolve NAT and proxies; IPv6 needs a separate rule. Guide examples may call for additional asset scope before interpretation.