Wireless surveillance is becoming increasingly important to protect the public security by legitimately eavesdropping suspicious wireless communications. This paper studies the wireless surveillance of a two-hop suspicious communication link by a half-duplex legitimate monitor. By exploring the suspicious link's two-hop nature, the monitor can adaptively choose among the following three eavesdropping modes to improve the eavesdropping performance: (I) \emph{passive eavesdropping} to intercept both hops to decode the message collectively, (II) \emph{proactive eavesdropping} via {\emph{noise jamming}} over the first hop, and (III) \emph{proactive eavesdropping} via {\emph{hybrid jamming}} over the second hop. In both proactive eavesdropping modes, the (noise/hybrid) jamming over one hop is for the purpose of reducing the end-to-end communication rate of the suspicious link and accordingly making the interception more easily over the other hop. Under this setup, we maximize the eavesdropping rate at the monitor by jointly optimizing the eavesdropping mode selection as well as the transmit power for noise and hybrid jamming. Numerical results show that the eavesdropping mode selection significantly improves the eavesdropping rate as compared to each individual eavesdropping mode.