OffSec Threat Hunter
OffSec Threat Hunter (OSTH)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The OffSec Threat Hunter (OSTH) certification validates foundational threat hunting skills on the defensive side of cybersecurity. It is earned by passing the exam associated with the TH-200 course, a Level 200 program with 54 hours of content organized into seven modules with hands-on labs and assessment questions. The credential suits SOC analysts, IT security specialists, and anyone building a threat hunting foundation or transitioning into a specialized security role; there are no formal prerequisites, though TCP/IP networking, Linux and Windows familiarity, and basic security concepts are encouraged. The exam is an 8-hour proctored hands-on threat hunting sprint: candidates identify indicators of compromise left by a threat actor, identify compromised systems, assess the impact of attacker actions, determine whether data was exfiltrated or encrypted, and report on findings. Preparation centers on the course labs and the comprehensive Challenge Lab, which combines the module skills and mirrors exam conditions. Tooling covered includes CrowdStrike Falcon, Splunk, Suricata, and Wireshark, applied to network and endpoint IoCs, ransomware and APT threat actor profiling, and behavioral analysis with data correlation. The certification expires three years after the pass date, with renewal options including a qualifying exam, a recertification exam, or the CPE program. This page is an independent study resource and is not affiliated with or endorsed by OffSec.
What you'll study
About OffSec Threat Hunter preparation
What does the OSTH exam actually require me to do?
It is a hands-on threat hunting sprint rather than a multiple-choice test. You identify indicators of compromise left by a threat actor, identify compromised systems, assess the impact of attacker actions, determine whether data has been exfiltrated or encrypted, and report on your findings. Expect to work across logs, network traffic, and endpoint telemetry using tools such as Splunk, CrowdStrike Falcon, and Wireshark.
How long is the exam, and is it proctored?
The exam is an 8-hour proctored session. OffSec states that all exams are proctored by an OffSec employee in a private VPN, so plan for a full working day in a controlled environment. Budget time for both the investigation and the written report, since findings must be documented and are graded.
Is there a report component, and does it count toward the result?
Yes. The exam description explicitly includes reporting on findings, and learner accounts describe an 8-hour hands-on challenge followed by a report on findings, both graded by OffSec. Treat documentation as a first-class deliverable: record affected hosts, evidence for each indicator, the impact assessment, and a clear conclusion on exfiltration or encryption.
Does the OSTH expire, and how do I renew it?
Yes, the OSTH expires three years after the date you passed the exam. OffSec lists three renewal routes before expiration: pass a qualifying OffSec exam in the same category at the same level or higher, take and pass a recertification exam within six months before expiration, or use the Continuing Professional Education program. If it lapses, you must retake and pass the same exam.
What background should I have before starting TH-200?
There are no formal prerequisites. OffSec strongly encourages a solid foundation in TCP/IP networking, familiarity with Linux and Windows operating systems, and a basic understanding of cybersecurity concepts, noting these can be found in its Threat Hunting Foundations Learning Path. Candidates with SOC or IT security experience will move faster through the labs and the Challenge Lab.
Which tools and topics does the course cover?
The course covers the threat actor landscape with emphasis on ransomware and APTs, network and endpoint indicators of compromise, IDS/IPS such as Suricata, ransomware groups including LockBit, CLOP, and BlackCat/ALPHV with exploited vulnerabilities, and custom hunting through behavioral analysis and data correlation using CrowdStrike Falcon. Learners also work with Splunk and Wireshark in the labs.
How should I sequence my study?
Work the seven modules in order, completing each associated hands-on lab and assessment question rather than reading passively. Then attempt the comprehensive Challenge Lab, which combines all course skills and is designed to prepare you for the exam. Practicing the full hunt-to-report cycle end to end, under time pressure, is the closest thing to exam conditions.
What are common failure modes on a hands-on hunting exam?
Typical pitfalls are chasing a single alert instead of correlating across network and endpoint data, failing to scope every compromised system, and stopping at detection without assessing impact or whether data was exfiltrated or encrypted. Weak reporting also costs points: vague findings without supporting evidence are hard to grade. Practice disciplined note-taking and structured hypotheses.
How much does the course and certification bundle cost?
The Course + Cert Bundle is listed at $1,749 once, described as the most popular option, and includes 90 days of access to one 200 or 300-level course, hands-on labs, and a single exam attempt. OffSec also lists a Learn One subscription at $2,749 per year, discounted during a promotion, which includes one year of access and two exam attempts.