Threat Hunting Training — Tehtris Academy
TehtrisAcademyBack to the catalogue

Instructor-led · SOC L1 → L2

Threat Hunting Training

An intensive upskilling path for SOC L1 analysts aiming for L2. From threat actor modeling to the crisis cell, through DFIR, epidemiology and weak-signal hunting, with AFEST and CTF in real conditions.

See the detailed programTraining objectives
Duration
5 days
Level
SOC L1 → L2
Methods
AFEST · CTF · Role-play · Epidemiology
Alignment
MITRE ATT&CK · DFIR · ENISA ECSF
Workshops
10 workshops · AFEST · CTF

Training objectives

Strategic objective

  • Train SOC L1 analysts to reach L2 level in advanced investigation and threat hunting

Operational objective

  • Advanced incident handling
  • Risk assessment and management
  • Vulnerability management
  • Containment and confinement actions
  • Autonomous Threat Hunting

Global objective

  • In-depth incident qualification
  • Mastery of DFIR processes
  • Application of advanced SOPs
  • Compliance with metrics and indicators
  • Operational maintenance (MCO)

Partial objectives

  • DFIR role and personal role
  • Advanced Incident Handling
  • Preventive Threat Intel: modeling / TTPs
  • Reactive Threat Intel: IOCs
  • Containment actions & security zones
  • Horizontal investigation & weak signals
  • Artifact Analysis: Delivery & Lateral movement
  • Security Posture Assessment
  • API Scripting · Crisis Reporting · SOP · Team Play

Skills covered

All skills are anchored in a hands-on workshop and assessed during the AFEST and CTF sessions.

DFIRDFIR role & personal roleIHAdvanced Incident HandlingUIInterface onboardingCTI+Preventive Threat Intel: modeling / TTPsIOCReactive Threat Intel: IOCsContainContainment actionsZonesSecurity zonesHuntHorizontal investigationSignalWeak signalsArtifactArtifact AnalysisDeliverDelivery & Lateral movementSPASecurity Posture AssessmentAPIAPI ScriptingCrisisCrisis ReportingSOPAdvanced operating proceduresTeamTeam Play & crisis communication

Detailed program: workshops & teaching methods

The progression follows field logic: we start from threat actors, build DFIR response capability, train hunting in simulated conditions, test in real conditions (AFEST), and consolidate with a malware analysis CTF.

MondayIntroductionThreat Actors

Framing & threat actor modeling

An opening day: presentation of the week's roadmap, then immersion in the DFIR role and the mapping of threat actors. The case study immediately anchors TTPs in documented real incidents.

Introduction: roadmap

Presentation of the path, upskilling objectives, expected deliverables and the assessment framework (AFEST + CTF).

Weekly objectivesLearning contractDeliverable: personal roadmap
Briefing

Threat Actors: DFIR role & TTPs

Positioning DFIR in the response chain. Modeling actors (APT, cybercriminals, insiders), mapping TTPs with MITRE ATT&CK, reading threat intelligence reports and extracting behavioral indicators.

DFIR roleTTPsMITRE ATT&CKPreventive Threat IntelActor modelingDeliverable: TTP mapping
Case study
TuesdayDFIRH.A.V.Initial Vector

DFIR response, epidemiology & initial vector

A dense day in three parts. DFIR and the H.A.V. approach (Host, Artifacts, Vector) are taught through an epidemiological analogy, a powerful mental frame to understand how a compromise spreads. The afternoon moves to initial vector analysis: artifacts, delivery mechanisms and lateral movement.

DFIR / H.A.V.: IOC & Containment

Applying the H.A.V. model (Host · Artifacts · Vector) to a real incident. Extracting and qualifying IOCs, containment decision, defining quarantine zones. Collaborative approach: each participant contributes to rebuilding the infection chain.

IOCH.A.V.ContainmentSecurity zonesReactive Threat IntelDeliverable: containment report
Analogy · Collab

Initial Vector: Artifacts, Delivery & Lateral movement

Analysis of malicious artifacts (macros, obfuscated scripts, droppers). Delivery techniques (phishing, watering hole, supply chain). Lateral movement mechanisms (pass-the-hash, WMI, RDP). Invoke-Obfuscation reference video for PowerShell deobfuscation.

Artifact AnalysisDeliveryLateral movementDeobfuscationInvoke-ObfuscationDeliverable: artifact analysis sheet
Case study · Video
WednesdayHuntingQualification

Threat hunting & incident qualification

The central day of the path. The morning relies on a bank-robber role-play to simulate hunting pressure under constraint (data volatility, limited time window, risk management). The afternoon is devoted to structured qualification and security posture assessment.

Hunting: Risk, Volatility & Reporting

Hunting methodology: hypotheses, sources, prioritization by artifact volatility. Operational risk management during active hunting. Structuring the hunt report (findings, coverage gaps, recommendations).

Horizontal investigationWeak signalsVolatilityRiskReportingDeliverable: hunting report
Bank-robber role-play

Qualification: Incident Mgmt & Security Posture Assessment

In-depth qualification of complex incidents, collaborative building of the attack timeline. Security Posture Assessment: mapping coverage gaps, identifying quick wins and structural remediation areas.

Incident ManagementSecurity Posture AssessmentMCOSOPMetricsDeliverable: SPA + incident timeline
Brainstorm · Mind map
ThursdayAFESTReal conditions

On-the-job training action (AFEST)

A full AFEST day. In the morning, autonomous hunting in a real environment: the learner hunts weak signals without guidance, applying their own hypotheses. The afternoon simulates an active crisis cell: multi-party coordination, crisis reporting under time pressure, application of communication SOPs.

AFEST Hunting: horizontal investigation & weak signals

Autonomous hunting on real data. The analyst formulates hypotheses, identifies relevant sources, hunts weak signals and documents findings. Assessment of methodological rigor and relevance of investigation pivots.

Horizontal investigationWeak signalsPivotsHypothesesAssessment: knowledge test
Knowledge test

AFEST Crisis Cell: Crisis Reporting & SOP

Simulation of a major incident in a multi-party crisis cell. Applying communication protocols, writing the crisis report under time constraint, coordinating with stakeholders (management, IT teams, legal). Assessment of decision clarity and SOP compliance.

Crisis ReportingSOPTeam PlayCommunicationAssessment: timed score
Race against the clock
FridayCTFWrap-up

Capture The Flag & week review

The day opens with a malware analysis CTF: participants face real samples and must rebuild the attack chain, extract IOCs and formulate containment recommendations. The wrap-up session closes on individual and collective assessment through a structured survey.

CTF: malware study

Forensic malware analysis in CTF conditions: identifying the type (RAT, ransomware, loader, stealer), extracting static and dynamic IOCs, rebuilding the infection chain, danger scoring. API Scripting to automate artifact extraction.

Artifact AnalysisForensicsIOC ExtractionAPI ScriptingInfection chainPractical cases
Practical CTF cases

Wrap-up: review & assessment

Structured week review, consolidation of learning, identification of individual areas for progress. Anonymous teaching-assessment survey and handover of the personal L2 upskilling roadmap.

ReviewAssessmentAreas for progressDeliverable: L2 roadmap
Survey · Assessment