Skip to content

Back to the catalog

bencteux.frarticle

ELearnSecurity Certified Threat Hunting Professional (eCTHPv2) review

A former eCIR holder reviews INE/eLearnSecurity's eCTHPv2 (Certified Threat Hunting Professional) certification, breaking down its three modules (intro to threat hunting, network hunting, endpoint hunting) and the practical labs covering YARA rule writing, Redline and Volatility memory analysis, Zeek/Rita and Netminer network analysis, and SIEM (Splunk/ELK) log hunting. It also details the 48-hour hands-on exam format and notes recent course updates covering AMSI bypass, Cobalt Strike execute-assembly, and reflective DLL loading detection, while flagging weak lab infrastructure (laggy RDP, slow Splunk labs) and thin network-hunting coverage relative to the endpoint module.

TL;DR Personal review of the eCTHPv2 threat-hunting certification's course content, tools, labs, and 48-hour practical exam.
Open original ↗
Document

What it is

A firsthand review of the eLearnSecurity/INE Certified Threat Hunting Professional v2 (eCTHPv2) certification, written by a former colleague of the course author (Slavi Parpulev) — a bias the author flags explicitly.

Cost and access

  • Certification: $400.
  • Requires an INE subscription: $749/year (all-access), or $899/year including former Pentester Academy content — which the author says is unnecessary.
  • The author's framing: cost amortizes across multiple certs, so eCTHPv2 makes more sense if you already hold or plan other INE certifications.

Positioning vs eCIR

The vendor markets eCTHPv2 as the "next stepping stone" after eCIR. The author disputes this: it is not a level up, not easier, and teaches largely different skills — with redundant overlap only on reading SIEM data (ELK, Splunk, Microsoft event IDs). Treat it as adjacent, not sequential.

Exam format

This is the detail the summary omits and the main reason to read:

  • Several scored "hunts"; 75/100 points to pass.
  • 48 hours of exam lab access, then 48 more hours to write and submit the report.

So it is a report-based (redaction) exam, not a click-through — budget for write-up time separately from lab time.

Course weighting

The three modules are unevenly balanced. The endpoint module is the largest and strongest (~20 labs, ~10 of them ELK/Splunk practice), and is the recently-updated part covering real tradecraft (AMSI bypass, Cobalt Strike execute-assembly, reflective DLL loading). The network module is good but "too short," and the author considers the webshell-hunting section misplaced — network depth sacrificed for one narrow attack type.

Caveats

  • The author openly declares bias (personal connection to the course author).
  • Operational downsides are recurring, not one-off: laggy RDP on some labs, "awfully slow" Splunk labs, and labs periodically unavailable due to maintenance — which the author calls "a recurring thing with eLearnSecurity these days."
  • Some labs (e.g. memory-dump analysis) can be done fully offline; others need VPN.

If you are weighing eCTHPv2 specifically as a post-eCIR progression, the actionable takeaway is: it isn't one, the value is concentrated in the endpoint module, and the exam demands a two-day report on top of two days of hunting.

Organisations named here

  • eLearnSecurity
  • INE
  • Slavi Parpulev

Technologies named here

  • YARA
  • Windows
  • Redline
  • Active Directory
  • Volatility
  • tcpdump
  • Wireshark
  • tshark
  • Netminer
  • Zeek
  • Rita
  • ELK
  • Splunk
  • PsExec
  • Empire
  • Cobalt Strike
  • PowerShell

Techniques named here

  • AMSI bypass
  • Cobalt Strike .NET loads via execute-assembly
  • Reflective DLL loading
  • Webshell hunting
  • Memory analysis
  • AD threat hunting
  • Network protocol abuse detection
  • Hunting with PowerShell
  • Log/SIEM-based hunting

Related in Learning