🏹 Ranger → Threat Hunter

“The alerts tell you what they found. Hunting tells you what they missed.”

Your Role in the Party

While SOC Analysts wait for alerts to fire, you venture into the wilderness of logs and telemetry to find threats that automated detection missed. You don’t wait for the enemy to announce themselves—you track them through the digital terrain before they reach their objective.

Threat Hunters are the proactive arm of defense. You develop hypotheses about adversary behavior, test them against your environment’s data, and either find evil or improve detection coverage. Either outcome is a win.

This role rewards curiosity. The best hunters are the ones who can’t stop asking “what if?” and who find genuine satisfaction in the chase—even when the trail goes cold.

---

📊 Your Stat Spread

Stat	Score	What It Means for You
WIS	⭐⭐⭐⭐⭐	Pattern recognition is everything. You see the anomaly in a million events that others scroll past.
INT	⭐⭐⭐⭐⭐	Deep knowledge of adversary tactics, frameworks, and how attacks actually work.
CON	⭐⭐⭐⭐	Hunts take time. You persist through hours of dead ends before finding the trail.
DEX	⭐⭐⭐	Pivot quickly between data sources and adjust hypotheses when evidence leads elsewhere.
STR	⭐⭐⭐	When you find something, you can execute response actions and contain threats.
CHA	⭐⭐	Document findings and communicate discoveries, though your work speaks for itself.

---

🎭 Neurodivergent Advantages

Your traits are class features, not bugs:

• Pattern Recognition (WIS): Autistic attention to detail notices the subtle behavioral anomaly that rules-based detection misses. Your brain naturally processes patterns in ways neurotypical analysts can’t replicate.

• Hyperfocus (INT): When you catch a scent, you can follow it for hours. ADHD hyperfocus is a superpower when the hunt gets interesting. You won’t stop until you’ve traced the full kill chain.

• Special Interest in Adversary Tradecraft: If you’ve ever hyperfocused on MITRE ATT&CK, malware analysis, or how attacks work—that knowledge directly translates to hunting hypotheses.

• Comfortable with Ambiguity: Hunting is inherently uncertain. You might find nothing, and that’s okay. Autistic comfort with systematic processes helps manage this uncertainty.

• Independent Work Style: Much of hunting is solo work—developing hypotheses, querying data, following trails. Less context-switching and fewer interruptions than reactive SOC work.

---

🗺️ Career Path

SOC Analyst → Threat Hunter → Senior Hunter → Hunt Team Lead → Threat Intel Manager
      ↓              ↓              ↓
 (Foundation)  (Specialization) (Leadership or
                                 pivot to Detection
                                 Engineering)

Common Ranger Multiclasses:

• Ranger/Druid: Threat Hunter → Threat Intelligence (combine hunting with intel production)
• Ranger/Rogue: Threat Hunter → Purple Team (understand offense to hunt better)
• Ranger/Artificer: Threat Hunter → Detection Engineer (build the rules, not just use them)

---

📜 Certification Pathway

Level 1-5: Foundation (0-2 years)

Certification	Org	Type	Cost	Why It Fits
CompTIA Security+	CompTIA	Multiple Choice	~$425	Foundation. You need to understand security basics before you hunt.
CompTIA CySA+	CompTIA	Multiple Choice	~$404	Behavioral analytics and threat detection—directly relevant to hunting.
BTL1 (Blue Team Level 1)	Security Blue Team	Practical (24-hr)	£399 ($500)	Hands-on incident response. Hunting builds on IR fundamentals.

Neurodivergent Note: Build your SOC foundation first. Hunting requires experience with what “normal” looks like before you can spot “abnormal.” CySA+ covers behavioral analytics that inform hunting hypotheses.

---

Level 6-10: Specialization (2-5 years)

Certification	Org	Type	Cost	Why It Fits
eCTHP (Certified Threat Hunting Professional)	INE Security	Practical	~$749/yr (subscription) + ~$400 (exam)	Purpose-built threat hunting cert. Hypothesis-driven methodology, hands-on exam.
GCFA (Forensic Analyst)	SANS/GIAC	Practical	~$999 (exam) + ~$8,500 (FOR508)	Advanced IR and threat hunting. FOR508 is legendary for hunt methodology.
GCTI (Cyber Threat Intelligence)	SANS/GIAC	Practical	~$949 (exam) + ~$8,275 (FOR578)	Threat intel lifecycle. Intel informs hunt hypotheses.

Neurodivergent Note: eCTHP is more accessible price-wise and specifically focused on hunting. FOR508 is the gold standard but expensive—consider if employer-funded. GCTI helps you generate better hypotheses from threat intel.

---

Level 11-15: Advanced (5-8 years)

Certification	Org	Type	Cost	Why It Fits
GCDA (Detection Analyst)	SANS/GIAC	Practical	~$999 (exam) + ~$8,500 (SEC555)	SIEM analytics and detection. Build the rules, not just query them.
CTIA (Certified Threat Intelligence Analyst)	EC-Council	Multiple Choice	~$449-$3,499	Threat intel methodology. Cheaper alternative to GCTI.
OSDA (Blue Team)	OffSec	Practical	~$1,649	Offensive Security’s blue team validation. Rigorous practical exam.

Neurodivergent Note: SEC555 (GCDA) is perfect if you want to move toward detection engineering. The course teaches you to make SIEMs actually useful, not just query them.

---

Level 16-20: Mastery (8+ years)

Certification	Org	Type	Cost	Why It Fits
GREM (Reverse Engineering Malware)	SANS/GIAC	Practical	~$999 (exam) + course	Deep malware analysis. Understand what you’re hunting at the code level.
GDSA (Defensible Security Architecture)	SANS/GIAC	Practical	~$999 (exam) + course	Design detection architecture. Senior-level visibility strategy.

---

🛠️ Your Toolkit

Primary Weapons

Tool	Type	What It Does	Link
Elastic Security	SIEM/Hunting	Hunt queries mapped to MITRE ATT&CK. Strong KQL query language.	elastic.co
Splunk Enterprise Security	SIEM/Hunting	Industry standard. SPL is powerful for complex hunts. ThreatHunting app available.	splunk.com
Velociraptor	Endpoint Hunting	Hunt across your fleet. VQL queries for endpoint artifacts.	docs.velociraptor.app

Hunting Platforms (Free/Low-Cost)

Tool	Purpose	Link
HELK	Hunting ELK stack with Jupyter notebooks and Spark. Built for hunters.	GitHub
Security Onion	Full hunting stack: ELK, Zeek, Suricata, Wazuh. Free and powerful.	securityonionsolutions.com
osquery	SQL-powered endpoint visibility. Query your fleet like a database.	osquery.io
Sigma	Generic detection rule format. Write once, translate to any SIEM.	GitHub
Chainsaw	Rapid Windows forensic artifact hunting. Fast triage tool.	GitHub

Detection & Simulation

Tool	Purpose	Link
Atomic Red Team	Execute ATT&CK techniques to test your detections.	GitHub
MITRE CALDERA	Automated adversary emulation. Run attacks to hunt for.	GitHub
DetectionLab	Pre-built lab environment for detection testing.	GitHub

Fun Tools from Awesome Lists

Source: awesome-threat-detection

Tool	What It Does
EQLLib	Event Query Language analytics mapped to ATT&CK
Zircolite	Standalone SIGMA-based hunting for EVTX and JSON logs
MITRE CAR	Cyber Analytics Repository—detection pseudocode for ATT&CK
ThreatHunting App	Splunk app mapped to ATT&CK to guide hunts
Sentinel Attack	Azure Sentinel queries leveraging ATT&CK

---

📚 Learning Resources

Free Resources

YouTube Channels:

• SANS Digital Forensics & Incident Response - Hunt methodology deep dives
• Black Hills Information Security - Active defense and hunting techniques
• 13Cubed - Windows forensics that feeds hunt hypotheses

Practice Platforms:

• TryHackMe - “Threat Hunting” and “Threat Intelligence” rooms
• CyberDefenders - Blue team CTFs including hunt challenges
• LetsDefend - SOC simulation with hunting scenarios
• Blue Team Labs Online - Hands-on hunting labs

Essential Reading:

• MITRE ATT&CK - Your hunting hypothesis framework
• ThreatHunter Playbook - Community hunting techniques
• Predefender Hunt Book - Free online hunting guide
• Splunk PEAK Framework - Hypothesis-driven methodology

---

Books for Rangers

Book	Author	Why Read It
Practical Threat Intelligence and Data-Driven Threat Hunting	Valentina Costa-Gazcón	THE hunting book. ATT&CK framework, hypothesis development, hands-on exercises.
Cyber Threat Hunting	Nadhem AlFardan	Comprehensive methodology from hypothesis to execution. Manning publication.
Crafting the InfoSec Playbook	Jeff Bollinger et al.	Building detection and response capabilities. O’Reilly.
Intelligence-Driven Incident Response	Scott Roberts & Rebekah Brown	Combining threat intel with IR and hunting.
The Practice of Network Security Monitoring	Richard Bejtlich	Classic NSM text. Foundational for network-based hunting.

---

Podcasts

Podcast	Why Listen
Detection Engineering Weekly	Newsletter/podcast on building better detections
SANS Internet Storm Center	Daily security updates—fresh hunt hypotheses
Risky Business	Weekly news with technical depth
Darknet Diaries	Adversary stories that inform hunt hypotheses

---

🎓 SANS Courses for Rangers

Course	Cert	Focus	Best For
FOR508: Advanced IR & Threat Hunting	GCFA	Hunt methodology, memory forensics, APT detection	Core hunting skills
SEC555: SIEM with Tactical Analytics	GCDA	SIEM optimization, detection engineering	Building detections
FOR578: Cyber Threat Intelligence	GCTI	Intel lifecycle, attribution, reporting	Intelligence-driven hunting
FOR572: Advanced Network Forensics	GNFA	Network-based hunting, packet analysis	Network-focused hunters
SEC599: Defeating Advanced Adversaries	GDAT	Purple team, APT defense	Understanding attacker perspective

---

🏆 Building Your Magic Items

Early Career Achievements:

• Complete TryHackMe “Threat Hunting” path
• Build a home lab with Security Onion or HELK
• Write your first Sigma rule
• Execute an Atomic Red Team test and hunt for artifacts
• Document a hypothesis-driven hunt (even if you find nothing)

Mid-Career Achievements:

• Conduct a hunt that finds real malicious activity
• Build a hunt playbook for your organization
• Present hunt findings to leadership
• Earn eCTHP or equivalent
• Contribute to ThreatHunter Playbook or Sigma rules

Senior Achievements:

• Lead your organization’s hunt program
• Speak at a security conference about hunting methodology
• Earn GCFA (FOR508) or equivalent
• Mentor junior hunters
• Publish hunt research or detection content

---

🧭 Multiclassing Guide

Adding Druid Levels (Threat Intelligence)

Combine hunting with intel production. Generate your own hypotheses from raw intel:

• SANS FOR578 for CTI methodology
• Study the Diamond Model and Kill Chain
• Practice with MISP and OpenCTI

“I don’t just hunt threats—I understand the adversaries well enough to predict their next move.”

Adding Rogue Levels (Offensive Skills)

Understand attacks to hunt them better:

• TryHackMe “Jr Penetration Tester” path
• Atomic Red Team execution and detection
• Study attacker tradecraft to build better hypotheses

“I know how to attack, so I know what artifacts to hunt for.”

Adding Artificer Levels (Detection Engineering)

Build the detection rules instead of just querying:

• Master Sigma rule format
• Learn your SIEM’s query language deeply (SPL, KQL, etc.)
• SANS SEC555 for detection engineering

“I don’t just find evil—I make sure we detect it automatically next time.”

---

💡 Neurodivergent Learning Strategies

For ADHD:

• Hunting’s variety helps—new hypotheses, new data sources, new challenges
• Use the “interesting trail” as motivation; follow what captures your attention
• Time-box hunts to prevent infinite rabbit holes (or embrace them when you can)
• Gamify: track hypotheses tested, detections created, evil found

For Autism:

• Build systematic hunt frameworks and checklists
• The structure of hypothesis → data → analysis → conclusion is comforting
• Deep-dive on specific adversary groups or TTPs as special interests
• Create comprehensive documentation of your hunt methodology

For Both:

• Leverage pattern recognition as your unfair advantage
• Use hyperfocus strategically when you catch a scent
• Independent work style fits hunting’s solo nature
• Your “weird” connections between disparate data points? That’s how hunts succeed.

---

🎯 Not Sure If You’re a Ranger?

Take the Character Creation Quiz to discover your cybersecurity class and get personalized recommendations!

---

📖 Continue Your Journey

• View All Classes
• Blue Team: Fighter - Build SOC foundations first
• Blue Team: Druid - If threat intelligence calls to you

---

“The adversary leaves traces. Your job is to find them before they finish the mission.”