HTB Certified Detection Engineering Principal

Preparing the CDEP

Designing solid detections from a low-level understanding of attack techniques on Windows and Linux: process injection, token manipulation, persistence, credential access.

Defensive · Detection engineeringPrincipalDetection Engineer path

The exam at a glance

Duration10 daysThe countdown never stops
Prerequisite13 modulesDetection Engineer path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowThe highest level of the range. The CDSA is not mandatory, but HTB strongly recommends it before starting.

Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.

Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.

Review

Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.

Module tracking

The 13 modules of the Detection Engineer path, grouped by theme. Tick them off as you go: progress is saved in this browser.

Foundations

  • Detection & OpSec Cyber Range
  • Introduction to Detection Engineering
  • Introduction to Dynamic Analysis with WinDbg

Low-level techniques

  • Process Injection Attacks and Detection
  • Linux Process Injections & Detections
  • Windows Low Level Detectability
  • Detecting Access Token Manipulation Attacks
  • Windows API Monitoring and Hooking
  • Windows Kernel Telemetry & Detection Techniques

Tradecraft analysis

  • Privilege Escalation Tradecraft Analysis
  • Persistence Tradecraft Analysis
  • WMI Tradecraft Analysis
  • Credential Access Tradecraft Analysis

What the exam assesses

  • Understand the telemetry an attack technique leaves behind, from user mode to the kernel.
  • Analyse behaviour dynamically with WinDbg.
  • Detect process injection, token manipulation and API hooking.
  • Analyse privilege escalation, persistence, WMI and credential theft.
  • Write robust, low-noise detections that are hard to bypass.
  • Document detections and their limits in a technical report.

Study plan

An example to adapt to your pace. Always alternate modules and practice.

  1. PrerequisiteCDSA level: SIEM, logs, Sysmon, ATT&CK.
  2. Month 1Foundations, WinDbg, low-level detectability.
  3. Month 2Injection, tokens, hooking, kernel telemetry.
  4. Month 3Tradecraft analysis and writing detections, then the report.

Exam tips

Specific to the CDEP

  • For each technique, note three things: how it works, what trace it leaves, how to detect it.
  • Think in behaviours (top of the Pyramid of Pain), not in easily changed indicators.
  • Test every detection against variants of the attack to measure its robustness.

Valid for every HTB exam

  • Split the time: keep at least a third of it for the report.
  • A screenshot at every key step, timestamped notes.
  • Stuck for two hours? Note the lead and move on.
  • Use the official template or SysReptor's from your practice runs onwards.

Review on this site

Methodology

Writing the report

Open →
 Certification

CDSA

Open →
 Methodology

Windows logs and Sysmon

Open →
 Cheat sheet

Sysmon configuration

Open →
 Cheat sheet

Windows Event IDs

Open →
 Cheat sheet

Sigma and YARA

Open →
 Methodology

Threat hunting

Open →
 Cheat sheet

SIEM queries

Open →
 Cheat sheet

Reference frameworks

Open →

Ready to book?

  • Detection Engineer path completed at 100%
  • Exam voucher available
  • Personal notes organised and easy to search
  • Report template ready, already used at least once
  • At least one full practice run under real conditions
  • 10 days blocked out in the calendar