ATT&CK Threat Hunting study guide
ATT&CK Threat Hunting · Work through your exam, one topic at a time.
ATT&CK Threat Hunting is a vendor-neutral certification aimed at security analysts, SOC hunters, detection engineers, and threat intelligence staff who want to prove they can turn the MITRE ATT&CK knowledge base into working hunt operations rather than a static spreadsheet of techniques. The exam tests the full hunt lifecycle: the structure of tactics, techniques, procedures (TTPs) and sub-techniques; mapping intelligence and incident findings to ATT&CK; writing falsifiable, hypothesis-driven hunt plans; choosing and validating telemetry across Windows, Linux, macOS, cloud and network sources; building behavioral queries and analytics; executing hunts, triaging results and separating true positives from benign administrative activity; and handing validated findings to detection engineering with a defensible coverage assessment. The ATT&CK Threat Hunting study guide has 7 sections and about 2,143 words.
01ATT&CK Framework Fundamentals and Data Model
This domain tests whether you can read ATT&CK as a structured knowledge base, not a list of alert names. Expect questions on tactic versus technique, sub-technique versus procedure, matrix scope, identifiers, and STIX relationships.
337 words, about 2 min02Threat Intelligence Mapping to ATT&CK
This domain tests conversion of threat intelligence into defensible ATT&CK mappings. The exam focuses on evidence quality, granularity, confidence, and the difference between an intrusion set, malware, and a behavior.
320 words, about 2 min03Hypothesis-Driven Hunting Design
This domain tests whether you can turn adversary knowledge into a falsifiable hunt. A strong hypothesis names the behavior, environment, telemetry, expected observables, and success criteria before querying.
311 words, about 2 min04Telemetry Sources and Data Quality (Windows, Linux, macOS, Cloud, Network)
This domain tests whether you know which telemetry can answer which behavior, and where visibility, retention, parsing, and fidelity limits create false confidence. Windows: Security 4688 gives process creation only when command-line auditing is enabled; 4624 and 4625 show logon outcomes; 4672 shows special privileges; 4698 shows scheduled task creation; 4697 shows service installation.
316 words, about 2 min05Detection Analytics and Behavioral Querying
This domain tests translation of a validated hypothesis into behavioral logic. Expect questions on correlation, weak-signal stacking, process ancestry, allowlisting, and ATT&CK-aligned analytic documentation.
276 words, about 1 min06Hunt Execution, Triage, and Validation
This domain tests disciplined execution and triage: preserving query context, reviewing hits consistently, validating evidence, and closing outcomes as confirmed, benign, inconclusive, or gap. Before execution, record query version, data sources, time range, scope, analyst, and expected benign patterns.
284 words, about 1 min07Detection Engineering Handoff and Coverage Assessment
This domain tests the transition from hunt finding to maintainable detection, and the ability to assess coverage without inflating it. Expect questions on handoff artifacts, testing, ownership, and ATT&CK coverage quality.
299 words, about 1 min