OffSec Threat Hunter study plan
OffSec Threat Hunter · Give each week a clear focus.
8 weeks · About 7 hours per week
Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs) & Threat hunting methodologies and enterprise defender practices
Map the threat-actor taxonomy used on the exam: nation-state APTs, eCrime ransomware operators, access brokers, and hacktivists, and write a one-line definition of each category
Build a comparison table of at least six named APT groups covering suspected sponsorship, primary initial-access technique, and typical post-exploitation tooling
Explain the intrusion lifecycle (initial access through impact) and align each phase to at least two concrete hunting hypotheses
Draft a one-page hunting charter that states scope, data sources, hypothesis format, and escalation path for a fictional enterprise
Your checkpoint
A threat-actor reference sheet (6+ groups, 4 categories) plus a one-page hunting charter, both saved as your own notes
Ransomware groups (LockBit, CLOP, BlackCat/ALPHV) and exploited vulnerabilities & Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)
Profile LockBit, CLOP, and BlackCat/ALPHV by affiliate model, leak-site extortion style, and preferred encryption or exfiltration behavior
List the specific vulnerabilities each of those groups has exploited (for example file-transfer and edge-device flaws) and state the exposed product and patch status for each
Trace a publicized intrusion from initial-access vulnerability to encryption and write the detection opportunity at each step
Identify which vulnerabilities in your list map to known exploited-vulnerability catalogs and rank them by exploitation likelihood
Your checkpoint
A ransomware-group dossier covering three groups, with a vulnerability-to-detection mapping table of at least eight entries
Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection & Threat hunting methodologies and enterprise defender practices
Categorize host IoCs (process ancestry, command lines, registry, file artifacts) and network IoCs (beacon jitter, DNS patterns, TLS metadata) with a concrete example of each
Distinguish atomic, behavioral, and anomaly indicators and explain when each is appropriate for proactive detection
Apply a structured analytic technique to a hunting hypothesis and document assumptions and bias risks
Write five hunting hypotheses in the form 'if adversary does X, we will observe Y in data source Z'
Your checkpoint
An IoC taxonomy document with 20 example indicators and five written hunting hypotheses
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), such as Suricata & Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection
Explain Suricata's rule anatomy (action, header, options, sticky buffers) and write at least five custom rules targeting the IoCs from week 3
Configure and run Suricata against a packet capture, then triage the alerts it generates
Compare signature-based IDS/IPS detection with behavioral hunting and describe evasion techniques that defeat naive signatures
Translate three network IoCs into detection logic and validate each against sample traffic
Your checkpoint
A working Suricata configuration with five custom rules, plus an alert-triage writeup showing true and false positives
Custom threat hunting: behavioral analysis and data correlation with tools such as CrowdStrike Falcon & Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection
Query endpoint telemetry in a Falcon-style console using process, network, and file event data to answer a specific hunting question
Correlate endpoint events with network telemetry to reconstruct one intrusion chain end to end
Build a behavioral detection for a living-off-the-land technique and document its expected false-positive sources
Apply a frequency or stack-count analysis to identify rare parent-child process relationships
Your checkpoint
A correlation report reconstructing one multi-stage intrusion, with queries and screenshots-free written evidence of each finding
Hands-on labs and Challenge Lab applying hunting skills end to end & Custom threat hunting: behavioral analysis and data correlation with tools such as CrowdStrike Falcon
Run a full hunting cycle on a practice dataset: hypothesis, data collection, analysis, finding, and detection output
Practice time-boxed triage under challenge-lab conditions and record your decision points
Convert at least two findings from the lab into reusable detection rules or saved searches
Write an after-action review identifying where your data coverage or analysis failed
Your checkpoint
A completed end-to-end hunting lab report with findings, detections produced, and an after-action review
Threat hunting methodologies and enterprise defender practices & Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS), such as Suricata
Define a detection-engineering lifecycle (requirement, design, test, deploy, tune, retire) and map your week 4 rules onto it
Design a coverage matrix that maps the MITRE ATT&CK techniques from weeks 1-2 to your available data sources and detections
Draft an enterprise defender playbook for a ransomware incident covering detection, containment, and evidence preservation
Explain how threat-intelligence feeds and vulnerability management inform hunting prioritization
Your checkpoint
A coverage matrix and a ransomware response playbook, each one to two pages
Hands-on labs and Challenge Lab applying hunting skills end to end & Threat hunting methodologies and enterprise defender practices & Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs) & Ransomware groups (LockBit, CLOP, BlackCat/ALPHV) and exploited vulnerabilities
Complete a timed mock exam or full challenge lab and score each domain to identify weak areas
Re-review your weakest two domains using your own notes and correct any errors found
Summarize the top five lessons from your after-action reviews and turn them into a personal checklist
Rehearse explaining a hunting methodology aloud in under five minutes as if briefing a stakeholder
Your checkpoint
A scored mock-exam or lab result with a written remediation plan for the two weakest domains
Milestones
Week 2: You can name three ransomware groups and, for each, one exploited vulnerability and the detection opportunity it creates, without notes
Week 4: Your Suricata rules fire on the intended traffic and you can explain each alert's true-positive or false-positive classification
Week 6: You have completed one full hunting cycle from hypothesis to detection output and documented the chain of evidence
Week 8: Mock-exam or lab scores show no domain below your target threshold, and a remediation plan exists for any gap