Beginner
Threat Hunting
ANOMALY
◎ BEGINNER500 XPAudio:ES
Threat Hunting Beginner
Practical threat hunting foundations with guided hands-on labs.
⬡ 1 guided lab◷ 10h of content
119 EUR
◈ Path Bundle
Threat Hunting
Proactive detection, hypothesis-driven hunting, and adversary behavior analysis across endpoints and networks using SIEM, EDR, and MITRE ATT&CK frameworks.
Save 79 EUR
Lab tools you will use
SplunkElastic SIEMVelociraptorYARASigmaOSQuerySysmonCrowdStrike FalconSplunkElastic SIEMVelociraptorYARASigmaOSQuerySysmonCrowdStrike Falcon
MITRE ATT&CK NavigatorKibanaWazuhChainsawHayabusaDeepBlueCLIKapeEric Zimmerman ToolsMITRE ATT&CK NavigatorKibanaWazuhChainsawHayabusaDeepBlueCLIKapeEric Zimmerman Tools
Courses Included
Intermediate
Threat Hunting
hunt> parent=winword.exe AND child=powershell.exe
MITRE T1059.001 match
▲ INTERMEDIATE750 XPAudio:ES
Threat Hunting Intermediate
Intermediate threat hunting with complex real-world scenarios and professional workflow.
⬡ 2 guided labs◷ 12h of content
159 EUR
Why Choose the Full Pack?
Get the Beginner + Intermediate courses bundled together and unlock exclusive extras.
Beginner + Intermediate courses (22h of content)
All 4 guided labs with isolated VMs
2 HTK certificates (Beginner + Intermediate)
1 exclusive bonus consolidation lab
Direct instructor support
Access to the HTK community
199 €278 €
Save 79 €Your Learning Roadmap
Each phase maps to a course module. Scroll to assemble your full progression — from beginner fundamentals to intermediate mastery.
Phase 1
BeginnerKnowing what you can actually see
Hunting is bounded by telemetry. The first honest exercise is establishing where your visibility ends.
- •Fill the gaps Windows leaves in its default logging
- •Understand what each data source can and cannot answer
- •Set retention against how long an intrusion realistically hides
Phase 2
BeginnerLearning what normal looks like
You cannot recognise the anomalous without a feel for the ordinary, and most false positives come from skipping this.
- •Baseline process, account and network behaviour in an estate
- •Recognise the administrative tooling attackers borrow
- •Tell scheduled noise apart from something acting on its own
Phase 3
BeginnerAsking the data a question
The query language is the instrument. This phase is about interrogating large volumes without drowning in results.
- •Write queries that narrow by behaviour rather than by keyword
- •Aggregate and pivot across hosts to surface outliers
- •Join endpoint and network evidence around one timeline
Phase 4
BeginnerYour first structured hunt
Running the loop end to end on a single technique, and writing it up so somebody else could repeat it exactly.
- •Turn a vague worry into one testable proposition
- •Decide in advance what evidence would confirm or kill it
- •Record the negative result as a finding, not a failure
Phase 5
IntermediateLetting the adversary set the agenda
Hypotheses stop being guesswork once they are driven by documented behaviour rather than by intuition.
- •Derive hunts from techniques relevant to your own estate
- •Prioritise by what an attacker would plausibly do next
- •Chain related techniques into a hunt that follows a whole intrusion
Phase 6
IntermediateHunting across thousands of machines
What works on one host has to survive contact with an entire estate, which is a different problem.
- •Query endpoints at scale and collect answers centrally
- •Triage volumes of event logs down to what merits attention
- •Sweep for an indicator across the estate and scope the blast radius
Phase 7
IntermediateMaking the hunt permanent
Anything you had to hunt for twice should have been a detection the first time. Here you close that loop.
- •Convert a confirmed hunt into a portable detection rule
- •Tune against real data until it is quiet enough to trust
- •Handle the variants that trivially evade a first draft
Phase 8
IntermediateProving what you cover
The last phase is the uncomfortable one: measuring how much of the adversary playbook you would genuinely notice.
- •Map real coverage against assumed coverage and find the gap
- •Separate what you detect from what you merely collect
- •Report to management in terms of risk rather than alert counts
What this path is
The Threat Hunting path teaches you to look for intrusions that no alert has fired on. That is the whole discipline: detection catches what somebody already anticipated, and hunting is the structured search for what nobody wrote a rule for yet.
It is hypothesis-driven from the start. Rather than staring at dashboards hoping something stands out, you learn to form a specific, testable proposition — a technique an adversary would plausibly use against this environment — then determine what evidence it would leave, go and look for exactly that, and either confirm it or rule it out. A hunt that finds nothing is still a result, provided you can say precisely what you ruled out.
The work happens across endpoint and network telemetry in a SIEM, on datasets carrying real adversary behaviour rather than synthetic alerts. Every hunt ends the way it should in practice: either an incident, or a new detection rule so the same behaviour never needs hunting again.
Who it's for
- SOC analysts who have outgrown alert queue work and want to go looking
- Detection engineers who want to validate their coverage against real behaviour
- Incident responders who need to establish scope quickly across many hosts
- Anyone with log analysis experience wanting to make it methodical
Who it's not for
- ·Anyone without prior exposure to security operations — hunting assumes you know what normal looks like
- ·People expecting a tool tutorial; the SIEM is the instrument, not the subject
What you need before starting
- Familiarity with security operations: what an alert is, what a SIEM does
- Comfortable reading logs — Windows events, network flows, process telemetry
- Basic query syntax in any language (SQL, KQL, SPL or similar)
- Working knowledge of MITRE ATT&CK as a vocabulary
The tools, and what each one is for
The path uses more tools than fit here. These are the ones that define the work.
| Tool | Category | What for |
|---|---|---|
| Splunk / Elastic SIEM | Analytics | Querying telemetry at volume, where hunts are actually executed |
| Sysmon | Endpoint telemetry | Producing the process, network and file visibility Windows lacks by default |
| Velociraptor | Endpoint hunting | Asking a question of thousands of endpoints at once and getting answers back |
| Sigma | Detection | Writing rules once in a portable format rather than per-SIEM |
| MITRE ATT&CK Navigator | Coverage | Mapping what you can actually detect versus what you assume you can |
| Chainsaw / Hayabusa | Event log analysis | Rapidly triaging Windows event logs at scale during an investigation |
| OSQuery | Endpoint state | Querying live endpoint configuration as though it were a database |
| Eric Zimmerman Tools | Forensics | Parsing the Windows artefacts that record execution and persistence |
What you finish with
Documented hunt hypotheses
Written so someone else can reproduce and extend the hunt
Sigma detection rules
Derived from behaviour you hunted, portable across SIEM platforms
An ATT&CK coverage map
An honest picture of what your telemetry does and does not see
A hunt report
Including negative results, which is what makes coverage claims credible
Where it leads
Hunting is usually where SOC analysts go when they want to stop reacting, and it is the skill set that separates a tier-one queue role from a senior detection position.
Threat Hunter
Proactively searches for undetected intrusions across the estate
Detection Engineer
Builds and tunes the rules that catch behaviour automatically
Senior SOC Analyst
Handles escalations and investigations the queue cannot resolve
Incident Responder
Scopes compromises and drives containment
Frequently Asked Questions
Complete answers about this path, labs, certificates, and refunds
Detection is automated and catches what someone anticipated. Hunting is a human, hypothesis-driven search for what no rule covers yet. They feed each other: a successful hunt should end in a new detection rule.
No. The labs provide the environment and the datasets, so you can complete the path without access to a production platform. What transfers is the method, which is not tied to any one product.
Yes, if scoped honestly. Small teams cannot hunt continuously, but a focused hunt against a specific plausible technique is achievable and often more valuable than broad monitoring nobody has time to read.
Enough to navigate it. The path uses it constantly as a shared vocabulary and to structure hypotheses, and builds familiarity as it goes — you do not need to arrive knowing technique IDs.
The reasoning it teaches is what those interviews probe: given this environment and this adversary, what would you look for and where. Being able to talk through hunts you have actually run, including ones that found nothing, is a strong signal.
No, provided it was specific. A well-scoped hunt that rules out a technique tells you something concrete about your exposure. Hunts that find nothing and cannot say what they ruled out are the failures.