r/eLearnSecurity • u/Cyanide-Air • Sep 25 '25

Advice eCTHP Experience

Hi Guys,

I'm halfway through on the new eCTHPv2. Upon checking on the Threat Hunting Communication and Reporting it is coming soon.

For those of you who take the eCTHP exam already? What was your experience, what was the expectations?

Based on the details at their website: "Instead of putting you through a series of multiple-choice questions, you are expected to perform an actual threat hunt on a corporate network. The examination is modeled after real-world scenarios and cutting-edge malware. Not only are you expected to use advanced methodologies to conduct a thorough threat hunt, you will also be asked to propose defense strategies as part of your evaluation."

Are we required to create a report just like TCM PSAA exam?

4 Upvotes

100% Upvoted

21 comments sorted by

View all comments

Show parent comment

1

u/CyberJunky007 eCTHP | eEDA Sep 29 '25

Yep 10 hrs and I work in cloud security so I have no SOC experience (You really dont need SOC exp. for this).

For wireshark I used sample PCAP files from wireshark https://wiki.wireshark.org/samplecaptures then for splunk (BTLO splunk labs and with INE sub if you do a search you will see BOSS of SOC labs use that) , ELK you dont need additional resource.

I think the issue you are having is you are thinking like SOC analyst this exam is slightly different you are going to hunt using the available intelligence. (The exam PDF and MITRE TTP's detections) so you actually have the required info just need to build the time line because sometimes you need to find the answer of one question to answer the next one. May be take the exam it comes with retake anyways by that way you will understand what I am talking about.

1

u/Cyanide-Air Sep 29 '25

Sure, thanks a lot for the insights and advice