OffSec TH-200 (OSTH) Threat Hunter– Online 90 days

While there are no formal prerequisites, it’s strongly recommended that you have:

• A solid foundation in TCP/IP networking
• Familiarity with Linux and Windows operating systems
• Basic understanding of cybersecurity concepts

We recommend the OffSec SEC-100 (CyberCore) for those new to cyber security.

The TH-200 course is designed for individuals looking to build a strong foundation in threat hunting, including SOC analysts, IT security specialists, and those aiming to transition into specialised cybersecurity roles. It provides comprehensive training in threat hunting methodologies and practical skills.

• Threat hunting concepts and practices
• Network and endpoint security
• Incident response and threat analysis
• Practical skills for roles in SOC analysis, threat hunting, and IT security

Topics covered in the Threat Hunting Course (TH-200)

• Threat Hunting Concepts and Practices

This module provides an overview of the basic objectives, concepts and practices of cyber threat hunting. It covers how enterprises implement threat hunting and the different stages and types of threat hunts.

• Threat Actor Landscape Overview

This module provides an overview of different types of threat actors with an emphasis on ransomware actors and Advanced Persistent Threats (APTs). It includes a number of more in-depth discussions of well-known threat actors.

• Communication and Reporting for Threat Hunters

This module introduces the way in which threat hunters receive and use threat intelligence and create threat reports. It covers the concept of the Traffic Light Protocol but does not cover IoCs.

• Hunting with Network Data

This module explores using Network Indicators of Compromise (IoCs) for proactive threat hunting. It highlights the role of Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), like Suricata, in monitoring for suspicious activities. Practical methods to identify signs of compromise in networks are covered, followed by hands-on exercises to develop threat detection skills.

• Hunting on Endpoints

This module provides an introduction to cyber threat hunting utilizing Endpoint IoCs. It covers intelligence-based and hypothesis-based threat hunting as well as considerations that improve the effectiveness of a hunt.

• Threat Hunting without IoCs

This module teaches threat hunting techniques that don’t rely on known IoCs. It covers custom threat hunting, focusing on behavioural analysis and data correlation to detect advanced threats. Tools like CrowdStrike Falcon are used to apply these methods in practical scenarios.

Exam (included in your course)

The OffSec Threat Hunter (OSTH) exam is a proctored, 8-hour hands-on assessment of your foundational threat hunting knowledge and practical skills. You’ll demonstrate your ability to identify, investigate, and respond to security threats in a simulated environment, focusing on real-world scenarios.

The OSTH certification expires three years after being awarded. Learners can maintain their OSTH designation by taking the recertification exam or completing the OffSec CPE program.

• Exam included
• Online exam voucher