ECTHP Exam Guide: Threat Hunting Skills and 6-Week Plan

The ECTHP (INE Certified Threat Hunting Professional) is an intermediate, hands-on exam that tests whether you can find attackers in network and endpoint data. Our voucher costs $234.99 and is emailed within 12 hours of payment. Most people with SOC or blue-team basics can prepare in about six weeks.

Below you get the skills to practice, the voucher terms, a study plan, and a worked hunt with commands you can run today.

What the ECTHP proves and who should take it

The ECTHP shows you can run a structured hunt. You form a hypothesis, search logs and traffic for evidence, and explain what you found. That is different from waiting for an alert to fire.

It suits people who already work with logs or incidents:

• SOC analysts (tier 1 or 2) who want to move toward proactive work

• Incident responders and DFIR beginners

• Blue-team engineers who build detections

• Pentesters who want to understand the defender's view

If you have never read a packet capture or a Windows event log, start with fundamentals first. Our Cybersecurity certification category lists entry points. The ECDFP exam guide is a good stepping stone into digital forensics.

How the hands-on threat hunting exam is set up

The ECTHP is a hands-on exam. You work with real evidence and explain your findings, so reading alone will not be enough.

INE can change exam details at any time. Confirm the current duration, question count and lab setup on INE's certification page before you book.

Threat hunting voucher cost, delivery and refunds

Our ECTHP voucher is $234.99 USD. You can buy it on the ECTHP voucher page. For INE's own current list price, check INE's site on the day you buy, since prices change.

Here is how delivery and refunds work:

• The voucher code is emailed within 12 hours of payment. It also appears in your account.

• You can cancel for a full refund before delivery.

• A delivered code is non-refundable. The exception is if the test provider rejects it as invalid, already used or expired on first use.

• In that case, contact support within 14 days with your order number and a screenshot. We replace or refund the code.

Threat hunting skill areas to master

Exact weights vary by version, so treat this as a practice map and not an official blueprint.

Worked example: hunting a beaconing host

Hypothesis: an infected host talks to a command server at regular intervals, often over DNS or HTTPS.

Start with DNS queries by source and name. Repeated queries to one odd domain stand out.

tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e ip.src -e dns.qry.name | sort | uniq -c | sort -rn | head -20

Then check timing. Look at the queries for one suspect domain and see whether the gaps are near-identical, such as every 60 seconds.

tshark -r capture.pcap -Y "dns.qry.name == \"suspect.example\"" -T fields -e frame.time_relative -e ip.src

Next, pivot to the endpoint. Search Security log event 4688 (process creation) for encoded PowerShell on the host that made those queries. This needs command-line auditing enabled.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 500 | Where-Object { $_.Message -match 'powershell.*-enc' }

Finally, write it up: hypothesis, evidence, host, time window, ATT&CK technique and recommended action. That write-up habit is what practical scenarios reward.

A realistic 6-week threat hunting study plan

This plan assumes 8 to 10 hours a week and prior networking knowledge.

1. Week 1 (8 hours): Hunt methodology and ATT&CK. Read how hunts are scoped and documented.

2. Week 2 (9 hours): Network data. Practice Wireshark display filters and tshark field extraction on sample captures.

3. Week 3 (9 hours): Windows endpoint logs. Study process creation, logon events and persistence locations.

4. Week 4 (10 hours): Hunt labs. Run two full hunts from hypothesis to write-up.

5. Week 5 (10 hours): Weak spots plus timed practice. Work offline, with no web searches, as a safe habit.

6. Week 6 (8 hours): Review notes, run one full-length timed mock session matching the duration INE lists, and rest the day before.

If you are new to log analysis, stretch this to eight weeks. The ECIR exam guide shows a similar hands-on rhythm.

Common mistakes

• Memorizing tools, not reasoning. Practical items reward how you think through evidence.

• Relying on web searches. Build the habit of using man pages and --help instead of Google.

• Spending too long on one question. Set a rough limit for each item, move on when you stall, and come back with fresh eyes.

• Skipping the write-up skill. Practice stating findings in two or three clear sentences.

• Booking before you have done real hunts. Watching videos is not the same as searching raw data.

After you pass

Update your resume and LinkedIn with the exact name: INE Certified Threat Hunting Professional (ECTHP). Then turn your practice hunts into a small portfolio of sanitized write-ups.

Good next steps include a detection engineering course, a DFIR certification, or a cloud security path. Browse our penetration testing category if you want the attacker's view to sharpen your hunts. Ready to start? Get your ECTHP voucher here.

Sources

• ECTHP Certified Threat Hunting Professional voucher (INE)