Threat Intelligence & Hunting — Study Course

The official preparation course for the Threat Intelligence & Hunting certification: structured modules, worked examples and exam-focused practice.

Key facts

• Course price: $195 (one-time payment)
• Field: Cybersecurity & Information Security
• Prepares for: Threat Intelligence & Hunting
• 7 modules · 23 lessons · about 5 hours of lessons
• Self-paced, online, illustrated lessons

Course outline

1. Foundations of Threat Intelligence — Establishes the core concepts, vocabulary, and lifecycle that underpin every threat-intelligence programme.
   • What Is Threat Intelligence and Why It Matters
   • The Intelligence Lifecycle
   • Indicators of Compromise vs Tactics, Techniques, and Procedures
   • Threat Intelligence Platforms and Sharing Ecosystems
2. MITRE ATT&CK Framework — Deep dive into the ATT&CK knowledge base — its structure, use cases, and how to apply it to detection, hunting, and intel analysis.
   • ATT&CK Structure: Matrices, Tactics, and Techniques
   • Mapping Intel Reports to ATT&CK
   • ATT&CK for Detection Gap Analysis and Coverage Heatmaps
3. Threat Actor Profiling and Adversary Intelligence — Build structured knowledge of threat actor groups, their motivations, and how to profile adversaries to anticipate their next move.
   • Threat Actor Categories and Motivations
   • Building a Threat Actor Profile
   • OSINT and Dark Web Intelligence Collection
4. Hypothesis-Driven Threat Hunting — Move from reactive alerting to proactive hunting — formulate, execute, and document structured hunt operations using real telemetry.
   • Threat Hunting Fundamentals and the Hunting Loop
   • Hunting Techniques: LOLBAS, Process Trees, and Beaconing
   • Hunt Operations: Planning, Execution, and Documentation
   • Hunting in Cloud Environments
5. Detection Engineering — Translate threat intelligence into durable, high-fidelity automated detections using Sigma, YARA, and modern SIEM platforms.
   • Detection Engineering Principles and the Detection Lifecycle
   • Sigma Rules: Writing Portable SIEM Detections
   • YARA Rules for Malware Detection
6. Operationalising Intelligence: From Intel to Action — Close the loop between intelligence production and security operations — automating intelligence workflows, measuring programme effectiveness, and integrating with SOAR.
   • Intelligence-Driven SOC Operations
   • SOAR Integration and Automated Intel Workflows
   • Measuring Intelligence Programme Effectiveness
7. Exam Readiness: Threat Intelligence & Hunting — Consolidate all key concepts, understand the exam structure, and build a confident exam-day strategy.
   • Key Concepts Recap: Intelligence and ATT&CK
   • Key Concepts Recap: Hunting and Detection Engineering
   • Exam Strategy and Practice Approach