Chapter 5 of 8 · Threat Hunting 62%

🧭 In 2013 analysts named a PLA hacking unit by its Shanghai building, with no single smoking gun. Could you turn scattered clues into a judgment a hunter can act on?

A feed of hashes is not intelligence. You'll run the analyst's craft: write the requirements that steer collection, map an adversary on the Diamond Model, and turn it into a hunt before any alarm fires. 🎯

Premium Chapter

Create a free account to access this chapter and start learning with hands-on labs.

Create Free Account

Ready to track your progress?

Create a free account to save your progress, earn XP, and access 170+ hands-on cybersecurity labs.

Start Learning Free

Course Progress

Track your learning journey

0 /8

0 % Complete

8 Remaining

Course Chapters

No chapters found for this filter

Threat Hunting

🧭 In 2013 analysts named a PLA hacking unit by its Shanghai building, with no single smoking gun. Could you turn scattered clues into a judgment a hunter can act on?

Premium Chapter

Ready to track your progress?

Course Progress

Course Chapters

Threat hunting foundations

The hunt loop

MITRE ATT&CK hunting

Endpoint and network hunting

Threat intelligence fundamentals

IOCs, feeds and platforms

YARA and Sigma detections

The hunt program