EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

Foundational Threat Hunting

Course outline

TH-20015 days
Discuss this programme →

Duration

TH-200: Foundational Threat Hunting

15 days (e-learning)

Overview

OffSec’s Foundational Threat Hunting (TH-200) equips cybersecurity professionals with the practical skills and knowledge needed to effectively detect and respond to threats. This course covers core threat hunting concepts, exploring the methodologies used by enterprises to track and mitigate adversaries. Key areas include understanding the threat actor landscape, with a focus on ransomware and Advanced Persistent Threats (APTs), and utilizing both network and endpoint Indicators of Compromise (IoCs) for proactive threat detection.

Upon successfully completing the rigorous hands-on exam, participants earn the OSTH – OffSec’s threat hunting certification. This credential demonstrates proficiency in foundational threat hunting practices, positioning certified professionals as valuable assets for roles in threat hunting, SOC analysis, and incident response teams.

Benefits

Upon completing TH-200 and successfully passing the OSTH exam, you’ll gain a strong foundation in:

  • Threat hunting concepts and practices
  • Network and endpoint security
  • Incident response and threat analysis
  • Practical skills for roles in SOC analysis, threat hunting, and IT security

About the exam

  • The TH-200 course and online lab prepares you for the OffSec Threat Hunter (OSTH) exam
  • 8-hour exam
  • Proctored

Target Audience

The TH-200 course is designed for individuals looking to build a strong foundation in threat hunting, including SOC analysts, IT security specialists, and those aiming to transition into specialized cybersecurity roles. It provides comprehensive training in threat hunting methodologies and practical skills

Prerequisites

While there are no formal prerequisites, it’s strongly recommended that you have:

  • A solid foundation in TCP/IP networking
  • Familiarity with Linux and Windows operating systems
  • Basic understanding of cybersecurity concepts

Syllabus

  • Threat Hunting Concepts and Practices
  • This module provides an overview of the basic objectives, concepts and practices of cyber threat hunting. It covers how enterprises implement threat hunting and the different stages and types of threat hunts.
  • Hunting with Network Data
  • This module explores using Network Indicators of Compromise (IoCs) for proactive threat hunting. It highlights the role of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), like Suricata, in monitoring for suspicious activities. Practical methods to identify signs of compromise in networks are covered, followed by hands-on exercises to develop threat detection skills.
  • Threat Actor Landscape Overview
  • This module provides an overview of different types of threat actors with an emphasis on ransomware actors and Advanced Persistent Threats (APTs). It includes a number of more in-depth discussions of well-known threat actors.
  • Hunting on Endpoints
  • This module provides an introduction to cyber threat hunting utilizing Endpoint IoCs. It covers intelligence-based and hypothesis-based threat hunting as well as considerations that improve the effectiveness of a hunt.
  • Communication and Reporting for Threat Hunters
  • This module introduces the way in which threat hunters receive and use threat intelligence, and create threat reports. It covers the concept of the Traffic Light Protocol but does not cover IoCs.
  • Threat Hunting without IoCs
  • This module teaches threat hunting techniques that don’t rely on known IoCs. It covers custom threat hunting, focusing on behavioral analysis and data correlation to detect advanced threats. Tools like CrowdStrike Falcon are used to apply these methods in practical scenarios.

Programme scope, delivery arrangements and suitability are confirmed during enquiry.