OffSec Threat Hunter study guide

OffSec Threat Hunter · Work through your exam, one topic at a time.

The OffSec Threat Hunter (OSTH) certification validates foundational threat hunting skills on the defensive side of cybersecurity. It is earned by passing the exam associated with the TH-200 course, a Level 200 program with 54 hours of content organized into seven modules with hands-on labs and assessment questions. The OffSec Threat Hunter study guide has 7 sections and about 2,451 words.

Threat Actor Landscape: Ransomware, APTs and Motivation

The threat actor landscape domain tests whether you can place an intrusion in the right actor category and predict the next move from motive, funding and tooling rather than from a single malware hash. Nation-state APTs - APT28 (GRU), APT29 (SVR, also tracked as Cozy Bear and Midnight Blizzard), Lazarus (DPRK) and APT41 (China, espionage plus financially motivated work).

366 words, about 2 min 02

Network and Endpoint IoCs for Proactive Detection

Network and endpoint IoCs are the raw material of proactive detection; this domain tests whether you know which indicators are durable, which decay in hours, and how to pivot between them without drowning in false positives. David Bianco's Pyramid of Pain ranks indicators by how much they cost an adversary to change: hash values (trivial), IP addresses, domain names, network and host artefacts, tools, then TTPs (painful).

344 words, about 2 min 03

IDS and IPS with Suricata: Rules, Modes and Reasoning

Suricata is the signature engine most often examined for IDS and IPS work. This domain tests rule syntax, deployment mode and whether you can read a rule and predict what it will and will not catch.

354 words, about 2 min 04

Ransomware Groups and the Vulnerabilities They Exploit

Ransomware groups and the vulnerabilities they exploit form a distinct domain because exam scenarios usually start with a CVE and ask you to recognise the operator behind the intrusion. LockBit - ran a large RaaS programme; LockBit 3.0 (Black) shipped a builder that leaked in 2022.

334 words, about 2 min 05

Custom Hunting with CrowdStrike Falcon: Behaviour and Correlation

CrowdStrike Falcon hunting tests your ability to turn endpoint telemetry into a defensible conclusion. Falcon records process, network, file, registry and DNS events from the sensor, and hunting means querying those events rather than waiting for a detection.

335 words, about 2 min 06

Hands-On Labs and the Challenge Lab: Hunting End to End

Hands-on labs and the Challenge Lab are where the other domains combine. You receive a dataset - PCAP, Windows event logs, Falcon-style JSON, memory or a mixed bundle - and must produce an evidence-backed answer under time pressure.

363 words, about 2 min 07

Threat Hunting Methodologies and Enterprise Defender Practice

Threat hunting methodology is what separates a hunt from alert triage. This domain tests the frameworks, the data sources and the feedback loop that turns a hunt into a durable detection.

355 words, about 2 min