What if attackers are already inside your network?

Don’t wait for alerts. Proactively hunt threats before they become incidents.

Modern cyberattacks are stealthy, persistent, and adaptive. Waiting for alerts is no longer enough.

Tenendo’s Threat Hunting service combines offensive and defensive expertise to uncover hidden threats before they become incidents proactively. We go beyond automated scanning to identify active compromises, misconfigurations, and critical detection gaps in your infrastructure.

Who Needs This?

  • Financial institutions (DORA, TIBER-EU compliance)
  • Companies with mature SOC/SIEM
  • Organisations post-incident
  • M&A due diligence scenarios

What We Typically Find

Common Detection Gaps We Uncover:

  • No tailored rules for IAM structure or high-value accounts
  • Missing detections for environment-specific services
  • Focus only on standard AD attacks (GPO, reconnaissance)
  • No coverage for sophisticated lateral movement techniques
  • Generic rules that adversaries easily bypass

Threat Hunting Detection Rules

Catalogue

The rules are organised according to the MITRE ATT&CK framework and cover detection capabilities for Windows, Linux, macOS, cloud environments, and container platforms.

Download

Tenendo Approach

1. Internal Threat Hunting (2 weeks)

We go beyond automated scanning to identify risks and potential compromises within your network.

  • Tabletop threat modelling and infrastructure analysis
  • Review of configuration, hardening, and runtime environments for key assets (PAM setup, credential storage, confidential data protection, critical networking, and server hosts)
  • Development and execution of custom compromise assessment queries and tools

Deliverable: A detailed report covering threat models, irregularities, and actionable improvement recommendations.

2. Purple Teaming (2-5 weeks)

We combine offensive and defensive expertise to validate and improve your detection capabilities.

  • Hands-on review of the current detection and monitoring setup
  • Proactive testing against ordinary C2, post-exploitation, and persistence techniques
  • Review and refinement of IOC ingestion and detection engineering processes

Deliverable: A technical report section detailing missing detections, flaws in detection setups or rules, and the techniques validated during the assessment.

3. Additional In-Depth Reviews (2 weeks)

We conduct targeted tests to identify overlooked vulnerabilities and security process gaps.

  • Manual testing of endpoint configurations (user devices and servers) against common initial access and persistence techniques
  • Review of integration and deployment processes and security of development infrastructure

Deliverable: A technical report section outlining test results, identified flaws, and clear recommendations for improvement.

What You’ll Receive:

  • Complete threat analysis report
  • Executive summary + technical appendix with detection rules catalogue
  • Prioritised remediation roadmap
  • 30-day follow-up consultation included

Why Choose Tenendo?

  • Proven methodology: We’ve found detection gaps in 100% of assessed environments
  • Real metrics: Our Purple Team exercises typically reveal 95%+ undetected scenarios
  • Not theoretical: We use actual adversary techniques, not generic checklists

Experience and accreditations

Cybersecurity:

  • OSCP – Offensive Security Certified Professional
  • OSEP – Offensive Security Exploitation Professional
  • CRTO – Certified Red Team Operator
  • CRTE – Certified Red Team Expert

Training Labs:

  • Hack The Box Pro Lab Offshore (Penetration Tester Level III)
  • Hack The Box Pro Lab RastaLabs (Red Team Operator Level I)
  • Hack The Box Pro Lab Cybernetics (Red Team Operator Level II)
  • Hack The Box Pro Lab APTLabs (Red Team Operator Level III)
  • Hack The Box Pro Lab BlackSky: Blizzard (GCP)
  • Hack The Box Pro Lab BlackSky: Cyclone (Azure)
  • Hack The Box Pro Lab BlackSky: Hailstorm (AWS)
  • VHL – Penetration Testing Course
  • VHL Advanced+ – Penetration Testing Course Advanced+
  • Evilginx Mastery – Evilginx Mastery
  • SEKTOR7 WE – Windows Evasion
  • SEKTOR7 MDI – Malware Development Intermediate
  • SEKTOR7 MDA 1 – Malware Development Advanced – Vol.1
  • SEKTOR7 MDA 2 – Malware Development Advanced – Vol.2
  • eWPTXv2 – Web application Penetration Tester eXtreme
CONTACT US