عراب ال IT 
امتحانات دوليه
TH-200
Offensive Security Threat Hunter (OSTH)
About the Certification
This is a professional certification from Offensive Security specialized in Threat Hunting, focusing on the proactive discovery of advanced threats within networks and systems before they are detected by traditional security tools.
The certification aims to prepare candidates to understand attacker behaviors, analyze security data, track Indicators of Compromise (IOCs), and correlate events to uncover stealthy and hidden attacks.
It covers Threat Intelligence, Behavioral Analysis, and advanced incident investigation, making it suitable for cybersecurity analysts, Blue Team members, and Threat Hunters seeking to work professionally within highly complex enterprise environments.
Main Curriculum
The curriculum is divided into seven main sections
- Threat Hunting Fundamentals and Mindset
-
- Threat Hunting concepts and why it is a proactive activity
- Difference between Detection and Threat Hunting
- Hunter mindset and hypothesis-driven methodologies
- Role of the Threat Hunter within SOC environments
- Data Sources and Metrics for Hunting
-
- Endpoint telemetry
- Network logs and flow data
- Authentication and identity logs
- Selecting appropriate data sources for each hunting scenario
- Endpoint and Network Threat Hunting
-
- Endpoint threat hunting
- Network threat hunting
- Lateral movement detection
- Credential abuse hunting
- Hunting Reporting, Metrics, and Continuous Improvement
-
- Documenting hunting results
- Hunting reports and findings
- Performance metrics and measurement
- Improving detection and defensive capabilities based on hunting outcomes
- Threat Landscape and Adversary Tradecraft
-
- Advanced attacker behaviors
- Tactics, Techniques, and Procedures (TTPs)
- Using the MITRE ATT&CK framework in hunting operations
- Understanding campaigns and persistent threats
- Hunting Techniques and Analysis
-
- IOC-based hunting
- Behavior-based hunting
- Anomaly detection (conceptual)
- Hunting Operations and Tooling
-
- Threat Hunting tools
- Using SIEM and EDR for proactive hunting
- Automation and scripting (high-level)
- Organizing and managing hunting operations
Exam Details
- Exam code: TH-200 (OSTH)
- Exam duration: 4 hours
- Number of questions: Practical + analytical (no fixed number of questions)
- Exam type: Threat Hunting analysis + log analysis, SIEM, network data + real defensive scenarios
- Language: English
- Passing score: 70%
- Exam fee: USD 800 – 1,500 (may vary by country and may include taxes)
- Certification validity: Lifetime
Do I need certifications before it ?
No, not at all.
However, it is recommended to have a solid understanding of threat analysis, Threat Hunting concepts, operating systems, and cyber defense fundamentals, following Offensive Security methodologies.
Which certifications are recommended after this one ?
Not mandatory. However, for those seeking a strong career path in cyber threat hunting from an adversary-focused perspective especially in proactive analysis, tracking attacker behaviors, and building effective Threat Hunting hypotheses the Offensive Security Threat Hunter (OSTH) certification is the strongest option.
What are the main uses of the Offensive Security Threat Hunter (OSTH) certification ?
- Advanced Threat Hunting & Detection Engineering – Deepening skills in hypothesis building, detection rule development, and improving security visibility.
- Incident Response & DFIR – Connecting proactive hunting with incident response and digital forensics.
- Purple Teaming – Integrating hunting with offensive techniques to enhance defense based on real adversary behavior.
- Threat Intelligence (CTI) – Leveraging threat intelligence to better guide hunting operations.
- Cloud Threat Hunting (AWS / Azure / GCP) – Applying proactive hunting in cloud and hybrid environments.
- Threat Hunting Lead / Detection Engineer – Transitioning into advanced leadership or engineering roles in cyber defense.
Practical Professionalism in Ethical Hacking :
This certification is considered one of the strongest hands-on certifications in cybersecurity. It proves your real ability to think like an attacker and analyze attacks professionally from a defensive perspective.
Earning it places you among the elite cybersecurity professionals and provides strong market value, backed by Offensive Security recognition.
Who is this certification suitable for ?
- Professionals currently working—or planning to work—as Threat Hunters or within Blue Team roles.
- Individuals with a strong foundation in SOC operations and Incident Response.
- Those interested in analyzing advanced attacker behaviors rather than relying solely on traditional alerts.
- Professionals aiming to develop proactive Threat Hunting skills and build advanced detection scenarios.
- Cybersecurity professionals seeking an advanced defensive certification that reflects real-world expertise.