Skip to Content

Certified Threat Hunting Professional (eCTHP)  


Request for price


Length: 5 day (40 hours)

 

This course shifts the defensive mindset from reactive (waiting for alerts) to proactive (hunting for anomalies). Unlike traditional SOC training, eCTHP focuses on the Hypothesis-Driven Hunting methodology. It covers the end-to-end hunting lifecycle: from leveraging Cyber Threat Intelligence (CTI) to generate a hypothesis, to performing deep-dive forensics across networks and endpoints using industry-standard tools like Splunk, ELK, and Wireshark.

The training is deeply practical, featuring over 25+ hands-on labs and a final examination that simulates a real corporate breach scenario where you must uncover the "silent" tracks of a sophisticated attacker.

The eCTHP is an intermediate-to-advanced level blue team certification. To succeed, you should have:

  • Networking Foundations: Deep understanding of TCP/IP, common ports, and protocols (HTTP, DNS, SMB, Kerberos).
  • Security Basics: Familiarity with the Cyber Kill Chain and MITRE ATT&CK frameworks.
  • Technical Skills: Basic comfort with the Linux command line and PowerShell.
  • Suggested Prior Experience: 1–2 years in a SOC or Incident Response role. While not mandatory, having the eCIR (Incident Responder) or eEDA (Defense Administrator) certification provides a solid foundation.
  • Tooling Knowledge: Previous exposure to SIEMs (Splunk/ELK) is highly beneficial, as the exam requires complex query building.

SOC Analysts (Tier 2 & 3): Looking to advance beyond basic alert triage.

Incident Responders: Who want to sharpen their ability to find dormant threats before they trigger a full-scale crisis.

Threat Intelligence Analysts: Who need to see how "Intelligence" is applied practically in a hunt.

Cybersecurity Engineers: Tasked with building and tuning detection rules based on hunting findings.

Blue/Yellow Teamers: Aiming to specialize in proactive defense and adversary emulation.

Course objectivesCourse outlines

Course objectives

After completing this course, students will be able to:

      • Develop Hypotheses: Create actionable hunting theories based on threat actor TTPs (Tactics, Techniques, and Procedures).
      • Master Network Analysis: Use Wireshark, Zeek, and RITA to detect C2 beacons, data exfiltration, and suspicious protocol tunneling.
      • Perform Endpoint Analysis: Hunt for "Fileless" malware, process injection, and persistence mechanisms in Windows/Linux.
      • Leverage SIEMs at Scale: Build advanced search queries in Splunk and ELK to correlate events across thousands of endpoints.
      • Utilize Forensics Tools: Use Volatility (Memory analysis) and Redline to find malicious artifacts in RAM.
      • Communicate Findings: Draft a professional Threat Hunting Report that includes remediation strategies and proposed defense improvements.


Course outlines

    • Domain 1: Introduction & Methodology
      • The Hunter Mindset: Proactive vs. Reactive.
      • Threat Hunting Maturity Model (THMM): Assessing where an organization stands.
      • Building a hunting team: Ad-hoc vs. Dedicated.
    • Domain 2: Cyber Threat Intelligence (CTI)
      • Types of Intel: Strategic, Tactical, and Operational.
      • Using YARA and OpenIOC to automate threat matching.
      • Integrating CTI feeds (MISP, AlienVault OTX) into the hunting process.
    • Domain 3: Threat Hunting Strategies
      • The Pyramid of Pain: Focusing on TTPs instead of just IP addresses/Hashes.
      • Hypothesis generation using MITRE ATT&CK and the Diamond Model.
    • Domain 4: Network Threat Hunting
      • Protocol Analysis: Hunting for anomalies in DNS, HTTP/S, and SMB traffic.
      • Identifying Lateral Movement and Command & Control (C2) channels.
      • Hunting for Webshells hiding in plain sight.
    • Domain 5: Endpoint Threat Hunting
      • Windows Internal Processes: Distinguishing "Known Normal" from "Known Evil."
      • Memory Forensics: Detecting code injection and reflective DLL loading using Volatility.
      • Advanced Logging: Utilizing Sysmon and Event Tracing for Windows (ETW).
      • Hunting with PowerShell (Kansa, Invoke-IR).
    • Domain 6: Communications & Reporting
      • Mapping findings back to the Cyber Kill Chain.
      • Recommending "Defensive Gaps" closures based on hunt results.
      • Drafting the final executive and technical reports.


Download Outlines