HackTheKnowledge logoES
BeginnerThreat Hunting10h of content · 1 guided lab500 XP

Threat Hunting Beginner

Learn proactive threat hunting fundamentals: hypothesis-driven detection, log analysis, and adversary behavior mapping with MITRE ATT&CK.

14-day money-back guarantee · No subscription · Lifetime access

Preview the student experience

No login · Free interactive demo

Try demo →

1

Guided lab

Isolated VM environment

10h

Of content

Labs + practice + exams + simulations

4

Modules

Progressive difficulty

2–4h

Per lab session

Unlimited restarts

HTKWhat's included
  • Full Beginner course (video lessons + written content)
  • 1-2 guided hands-on labs in an isolated VM
  • Per-module exams
  • HTK Beginner certificate
  • Lifetime access, unlimited lab restarts
  • Expert instructor reviews your reports & assignments
119 €159 €

One-time payment, no subscription

Start Learning →

Lab tools you will use

SplunkLab toolElastic SIEMLab toolVelociraptorLab toolYARADetectionSigmaDetectionOSQueryLab toolSysmonEndpoint logsCrowdStrike FalconLab toolSplunkLab toolElastic SIEMLab toolVelociraptorLab toolYARADetectionSigmaDetectionOSQueryLab toolSysmonEndpoint logsCrowdStrike FalconLab tool
MITRE ATT&CK NavigatorLab toolKibanaLab toolWazuhSIEMChainsawLab toolHayabusaLab toolDeepBlueCLILab toolKapeLab toolEric Zimmerman ToolsLab toolMITRE ATT&CK NavigatorLab toolKibanaLab toolWazuhSIEMChainsawLab toolHayabusaLab toolDeepBlueCLILab toolKapeLab toolEric Zimmerman ToolsLab tool

Before you start — quick answers

Not for beginner courses. They start from scratch with guided, step-by-step instructions.

Each lab session opens a 2–4 hour maximum VM session window. You can restart it as many times as you need — unlimited restarts are included with your purchase.

Yes. Unlimited restarts are included with your purchase. Practice as much as you want.

Yes. Your HTK certificate is issued upon completing the final lesson of the last module. Course progress is sequential — each lesson unlocks the next.

Course Syllabus

4 modules · 10h of content

Each phase maps to a module in this course. Scroll to see how the curriculum builds, module by module.

1

Module 1

Beginner

Threat Hunting Fundamentals & Adversary Behavior

  • •Reactive vs. proactive detection: why hunting matters
  • •MITRE ATT&CK framework: tactics, techniques, and procedures
  • •Threat intelligence-driven vs. hypothesis-driven hunting
  • •Module theory exam
2

Module 2

Beginner

Log Sources & Telemetry Collection

  • •Windows event logs: Security, Sysmon, PowerShell logging
  • •Network telemetry: DNS, proxy, NetFlow
  • •Configuring collection with Sysmon and OSQuery
  • •Module exam
3

Module 3

Beginner

Hunting Techniques & Tools

  • •Splunk and Elastic SIEM: queries, dashboards, and correlations
  • •Sigma rules: writing and converting detection logic
  • •Identifying persistence, lateral movement, and C2 patterns
  • •Module exam
4

Module 4

Beginner

Reporting & Certification Exam

  • •Documenting hunt findings: timelines, IOCs, and recommendations
  • •Measuring hunt program maturity and effectiveness
  • •HTK final certification exam

What you will learn

  • Run a hypothesis-driven hunt mapped to the MITRE ATT&CK framework
  • Collect and analyze endpoint and network telemetry to surface adversary activity
  • Write Sigma detection rules and document findings in a reproducible way

Hands-on Lab

Receive real endpoint and network telemetry from a compromised environment and identify adversary activity using Splunk, Sigma rules, and MITRE ATT&CK mapping. The lab automatically validates each finding.

1⬡ 1 guided lab
2–4hSession window
UnlimitedRestarts
AutoFlag validation
Experience a lab preview →

Requirements

  • ·Modern web browser
  • ·Stable internet connection
  • ·No local installation required
  • ·Basic technical English recommended

Frequently Asked Questions

Complete answers about this course, labs, certificates, and refunds

Not for beginner courses. They start from scratch with guided, step-by-step instructions.

Each lab session opens a 2–4 hour maximum VM session window. You can restart it as many times as you need — unlimited restarts are included with your purchase.

Yes. Unlimited restarts are included with your purchase. Practice as much as you want.

Yes. Your HTK certificate is issued upon completing the final lesson of the last module. Course progress is sequential — each lesson unlocks the next.

Yes. 14-day money-back if lesson progress is below 20% and you have not completed the HTK certificate path (all lessons + labs) for that course. Details in our Refund Policy.

Yes. Once purchased, you have permanent access to all course materials and future updates.

Yes. All professional tools come pre-installed and configured in the VM, no local setup needed.

Most students complete the course in 2–4 weeks studying part-time. You set your own pace.

Ready for the next level?

Threat Hunting Intermediate

You've covered the fundamentals. Threat Hunting Intermediate builds on this course with more complex real-world scenarios, higher-difficulty labs, and advanced analysis workflow.

◷ 12h of content⬡ 2 guided labs159 €
View Intermediate Course →
Ready to level up?

Build real Threat Hunting skills

Get hands-on with real Threat Hunting scenarios, professional-grade tools, and validated flag objectives. No prior experience needed.

From119€or 199 € for the complete path
One-time payment, no recurring chargesLifetime access, course updates included14-day money-back guarantee