Detect known unknowns
summary
Pandora Project builds a TTP‑focused hunting pipeline that avoids single points of failure by using both EDR and CMs plus three detonation VMs to reproduce attacker behaviors. Atomic Red is used for testing and shows EDR and CM missed detection for common admin tooling, while custom analytic rules (KQL/Sigma style) generate alerts. Deliverables include playbooks, gap fixes (new logs, sensors), baselining guidance, and measured results proving increased visibility and reduced dwell time after rule deployment.
AI-written summary · about
chapters (18)
- 0:00intro
- 1:43preamble
- 2:39about fulvio
- 3:09pyramid of pain
- 4:14is it necessary ?
- 5:23three main focus poins of the pandora project
- 6:45a tailored defensive solution
- 7:37ttp based threat hunting
- 8:47methodology workflow
- 12:43baseline and its impact
- 15:16threat model
- 16:06testing environment
- 17:53deliverables
- 19:05use case
- 20:44testing phase
- 21:05results
- 22:09what next ?
- 23:24thank you, questions ?
related talks
29mDetection Engineering: Defending Networks with Purpose
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
41mPurple Is the New Red - Providing the Most Value from Offensive Security
52mBuilding the Always-On Purple Team
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
40mFantastic Red-Team Attacks and How to Find Them
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
39mThe PR3TACK Initiative: Building the World’s First Preemptive Tactics & Countermeasures Knowledgebas