Threat Hunter
Proactively search for hidden adversaries using hypothesis-driven analysis.
3 modules · ~4 weeks
Modules
01Network Threat Hunting — Beacons, Long Connections, DNS, TLS
advancedHunt for adversary network behavior proactively — beaconing C2, DNS tunnelling, JA3 anomalies, and long-tail connections — before any alert fires. Convert findings to Sigma rules.
5 lessons
02Host & Memory Hunting at Scale
advancedHunt for adversary artifacts across an entire fleet using Velociraptor VQL, analyze memory with Volatility 3, and reconstruct attacker timelines with Plaso super-timelines.
6 lessons
03CTI-Driven Hunting & Hypothesis Engineering
advancedTransform CTI reports into testable hunt hypotheses, extract TTPs from threat intelligence, map confidence levels to ATT&CK, and produce calibrated hunt assessments.
5 lessons
// final assessment
Final Exam
20 hard, scenario-based questions spanning the full curriculum. Pass at 80% to earn your certificate.