• Threat hunting methodology: hypothesis-driven hunts, intelligence-led and TTP-based approaches, MITRE ATT&CK mapping
• Cyber threat intelligence: IOCs/IOAs, threat actor profiling, Diamond Model, Cyber Kill Chain, and intel-driven hunting
• Log and telemetry analysis: Windows Event Logs, Sysmon, Linux auditd, DNS, proxy, and firewall logs
• SIEM and EDR use: building queries and correlation rules (Splunk, Elastic, Microsoft Sentinel), and baselining normal behavior to spot anomalies
• Network traffic analysis: Wireshark, Zeek, NetFlow, and detection of C2 beaconing, lateral movement, and data exfiltration
• Endpoint and memory forensics: process, persistence, and registry analysis, plus Volatility and Velociraptor basics

https://ftp.kr-labs.com.ua/Certifications/VM2R5HFHNSHL.pdf

• Penetration testing methodology: Cyber Kill Chain, MITRE ATT&CK, scoping, rules of engagement, and risk-based reporting (CVSS)
• Reconnaissance and OSINT: footprinting, DNS/subdomain discovery, passive and active information gathering
• Network scanning and enumeration: Nmap, service and OS fingerprinting, SMB/SNMP/LDAP/DNS enumeration
• Vulnerability assessment: Nessus/OpenVAS scanning, analysis, and risk prioritization
• System exploitation: Metasploit, password attacks and hash cracking, privilege escalation on Windows and Linux
• Malware fundamentals: types of malware, backdoors, ransomware, and basic static/dynamic analysis

https://ftp.kr-labs.com.ua/Certifications/ECC-CEH-Certificate_KR.pdf