ATT&CK Threat Hunting
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
ATT&CK Threat Hunting is a vendor-neutral certification aimed at security analysts, SOC hunters, detection engineers, and threat intelligence staff who want to prove they can turn the MITRE ATT&CK knowledge base into working hunt operations rather than a static spreadsheet of techniques. The exam tests the full hunt lifecycle: the structure of tactics, techniques, procedures (TTPs) and sub-techniques; mapping intelligence and incident findings to ATT&CK; writing falsifiable, hypothesis-driven hunt plans; choosing and validating telemetry across Windows, Linux, macOS, cloud and network sources; building behavioral queries and analytics; executing hunts, triaging results and separating true positives from benign administrative activity; and handing validated findings to detection engineering with a defensible coverage assessment. Expect scenario-based multiple-choice and multiple-response items that describe an environment, a partial data set and a suspicious behavior, then ask what to query, which technique is in play, or why a hunt produced noise. Preparation works best in layers: learn the framework data model and navigation first, then practice mapping real public threat reports to techniques, then write and run hunts in a lab with realistic logging (Sysmon, auditd, cloud audit logs, proxy and DNS data), and finally rehearse documenting coverage gaps. Candidates who only memorize technique IDs usually struggle; those who can reason about data quality and attacker behavior do well. Confirm current fees, scheduling, retake rules and validity periods with the certifying organization, as these details change.
What you'll study
About ATT&CK Threat Hunting preparation
What is the exam format?
Items are multiple choice and multiple response, typically presented as short scenarios with a described environment, available log sources and observed behavior. Multiple-response items usually state how many answers to select. The certifying organization publishes the authoritative format, item count and time allowance on its website; check there before scheduling.
How difficult is it, and do I need hands-on experience?
It sits above entry-level security certifications. Candidates with a year or more of SOC, incident response or detection work find the scenarios familiar. Without hands-on log analysis you will likely recognize technique names but misjudge which telemetry actually answers the question, so lab practice matters more than reading.
What should I study first?
Start with the ATT&CK data model: tactics versus techniques versus procedures, sub-technique naming, software and group pages, and how mitigations and detections are documented. Then move to mapping public threat reports, and only after that to hunt design and query writing. Jumping straight to queries leaves gaps in framework reasoning that scenario items exploit.
How much time should I plan for preparation?
Most working analysts need several weeks of part-time study: roughly a week on framework structure, a week mapping intelligence, and two or more weeks writing and running hunts in a lab. If you are new to the telemetry side, add time for Windows event logging, Linux audit and cloud audit trail familiarity.
What are the most common failure modes?
Candidates confuse tactics with techniques, pick a query that cannot work because the required telemetry is not collected, or treat a single suspicious event as proof without considering baseline administrative behavior. Others ignore data quality issues such as missing command-line logging. Read the scenario's stated log sources carefully; the intended answer usually respects them.
Do I need to memorize technique IDs?
Recognizing common IDs helps speed, but items generally test behavior and reasoning rather than recall of numbers. You should know high-frequency techniques well enough to map a described action to the right tactic, and understand sub-technique granularity. Rote memorization of the full matrix is a poor use of study time.
What happens if I fail, and how long is the certification valid?
Retake policies, waiting periods and recertification or validity terms are set by the certifying organization and change over time. This page does not state them. Consult the official program page or your candidate handbook for the current retake rules, any fees, and renewal requirements before you book.
How is the exam delivered and scheduled?
Delivery method, testing options, scheduling windows and identification requirements are administered by the certifying body. Check its official site for current availability and any remote-proctoring rules. Do not rely on third-party summaries, which are often outdated.
Can I use ATT&CK itself during study?
Yes. The framework is publicly available and is the primary reference. Work through the matrix, read technique detection notes critically, and practice translating them into queries against logs you can generate in a lab. Treat the framework as a working tool, not a text to memorize.
Is this an official MITRE certification page?
No. This is independent study material for candidates preparing for an ATT&CK-focused threat hunting credential. It is not affiliated with, endorsed by, or sponsored by MITRE or any certifying body. Always verify exam details against the official program documentation.