Skip to content

Aurora Lite Hands-on Labs

Choose the route that fits your available time and computing resources. Use the Interactive Lab for a short guided investigation with no installation, or the Full Lab to install Aurora Lite and validate the same workflow on an isolated Windows VM. These are alternative routes; you do not need to complete both.

Hands-on endpoint proof of concept

Prepare it. Detect it. Explain it.

Build or restore one isolated Windows VM, verify Aurora Lite, generate a safe process event, investigate the resulting Sigma match, and validate one bounded improvement without mistaking test activity for compromise.

⏱ 2–3 hours core◆ Guided beginner✓ Evidence required
Start the Full Lab
Self-hosted · 2–3 hours

Aurora Lite Full Lab

Installation required

How to use the detailed journeys

Keep this page open as your mission guide. Follow only the linked sections for the current activity, then return here and confirm the checkpoint. The product journeys retain the complete original procedures, options, and screenshots when you need more detail.

Use an isolated, authorised environment

Perform the beginner route with harmless Aurora function tests on a Windows VM you own or are authorised to use. Take a clean snapshot before enabling response actions. Live malware is not required for this Full Lab.

Before you begin

You need: an x86-64 computer with virtualisation enabled, an isolated supported Windows VM, administrator access, an Aurora Lite licence and package, temporary authorised download access, enough resources for the selected Windows version, and a folder for screenshots and notes.

How to use this lab

Complete one session at a time. Record values that differ from the examples. Stop at a checkpoint when the expected result is missing; fix that boundary before changing configuration or running another test.

Recommended first

Beginner Core Lab

Use one isolated Windows VM. Verify Aurora, reproduce whoami /priv, compare the match with a benign event, and test one additional harmless function.

Expected time: 2–3 hours across three sessions.

Optional specialist extension

Historical WannaCry PoC

The preserved ransomware challenge requires specialist malware-handling controls. It is not required to complete the beginner Full Lab.

Expected time: a separate supervised session.

  1. Session 1Prepare, install, and snapshot
  2. Session 2Detect and investigate
  3. Session 3Extend, report, and recover

Objective

You are validating Aurora Lite for a small SOC proof of concept under change ticket CHG-1042. Prove that the agent is healthy, one controlled Windows event produces the expected Sigma match, the record contains enough context to explain the result, and one additional test behaves as predicted.

The beginner route uses:

  • one isolated, supported Windows VM with a recoverable snapshot;
  • Aurora Lite with its local dashboard and Standard preset; and
  • harmless commands and routine Windows activity for comparison.

01

Activity 1: Prepare and install

Record the starting state

Create a lab note for CHG-1042 and record the VM hostname, Windows version, address, administrator account, network mode, Aurora version, download source, licence constraint, and snapshot name. Confirm that the VM cannot reach production systems.

Build the working baseline

  1. Build or restore one isolated Windows VM and apply the intended baseline.
  2. Take a clean base-windows snapshot before installing Aurora.
  3. In Install and verify, complete Before you begin, Download the package, Install with the dashboard, and Verify the baseline.
  4. In Aurora Status, confirm the agent service is Running, the Standard configuration is active, and Sigma rules have loaded successfully.
  5. Open the local dashboard and note the time shown by Windows.
  6. Take a working-aurora-core snapshot after every health check passes.
Milestone 1Healthy endpoint baselineThe isolated VM has recorded details, Aurora is running with loaded rules, the dashboard opens, and both clean and working snapshots exist.
Need another installation method or configuration option?

The later sections of Install and verify preserve the original command-line, service, dashboard, system requirement, update, and exclusion instructions. Configure and maintain preserves custom settings, manual signature management, and removal procedures. These are references, not additional requirements for the Beginner Core Lab.

Expected result Aurora Status shows a running agent, Standard configuration, and successfully loaded Sigma rules; the dashboard opens and the recoverable working-aurora-core snapshot is recorded.

02

Activity 2: Detect and investigate

Restore or clone working-aurora-core. Confirm the Activity 1 health checks still pass before generating an event.

Predict the result

Before running the command, write down your prediction: a process-creation event should match a Sigma rule because whoami.exe requests privilege details. This prediction is a test hypothesis, not a claim that the endpoint is compromised.

Generate and trace one safe event

  1. Record the current time in your CHG-1042 note.
  2. Run the following command from an ordinary PowerShell or Command Prompt window, not from the Aurora dashboard:
whoami /priv
  1. Return to the dashboard, refresh the event list, and locate the match using the execution time and rule title.
  2. Expand the event and record the rule title, severity, match condition, image, command line, user, parent process, host, and timestamp.
  3. Find a routine signed service or updater event near the same time. Compare its executable path, publisher where available, parent, command line, rule match, and severity with the controlled event.
  4. Use the investigation loop and screenshots in Test and investigate if your fields or interface differ.

Answer these questions:

  • Which evidence connects the command you ran to the Aurora event?
  • Why did the Sigma rule match?
  • Which fields distinguish it from the routine comparison event?
  • What does the result prove, and what does it not prove?
Milestone 2Controlled detection explainedYou traced a known command into Aurora, compared it with benign activity, and classified it as an authorised validation event rather than a confirmed compromise.

Expected result The controlled command produces the expected Sigma match, its process and timing fields connect it to your test, and the benign comparison is not incorrectly included in the finding.

03

Activity 3: Extend and report

Reuse the working Activity 2 baseline. Change only one variable at a time and keep working-aurora-core as the rollback point.

Validate one additional function

  1. Choose one harmless test from the preserved function-test walkthrough.
  2. Before running it, predict the event source, match type, and likely severity.
  3. Run the positive test, record its exact execution time, and preserve the matching event.
  4. Run or identify a benign negative control that should not match the same rule.
  5. Compare the actual result with your prediction and explain any difference.
  6. Optionally reproduce the reversible Notepad response validation. Simulate first, preserve the detection, and confirm recovery before enabling any stronger action.

Write the analyst verdict

Use this structure in your CHG-1042 note:

Test and execution time:
Host and user:
Aurora version and preset:
Matched rule and severity:
Observed process and parent:
Benign control:
Disposition:
What the evidence proves:
What the evidence does not prove:
Recovery and cleanup completed:

Restore the working snapshot if the baseline changes unexpectedly. Otherwise, remove harmless test artefacts and temporary exclusions that are no longer approved.

Milestone 3Validation recordedAnother analyst can reproduce the test, distinguish its positive and negative cases, understand the bounded conclusion, and verify cleanup.
Optional specialist challenge

The historical WannaCry proof-of-concept challenge is a separate advanced route. Do not proceed unless every readiness control on that page is satisfied and appropriate supervision is available. It is not a graduation requirement for this Full Lab.

Expected result Your evidence contains a positive result, a benign negative control, the exact configuration used, a conclusion limited to what the records prove, and confirmation that the endpoint returned to its known-good state.

Full Lab evidence checklist

This checklist applies to the VM-based Full Lab. If you completed the Interactive Lab, retain its downloaded evidence summary instead. The specialist ransomware extension is not required.

0 of 8 recorded Mark each item when you have saved the evidence.

Troubleshooting

Symptom First check
Dashboard does not open Confirm the Aurora service is running and that you are using the configured local dashboard address.
No event appears Confirm service health, Standard preset coverage, the test timestamp, and dashboard refresh before repeating the command.
Rule compilation error Preserve the error, identify the affected rule, and confirm whether the remaining rules loaded before editing anything.
Duplicate-looking events Compare event IDs, timestamps, sources, and match fields before treating them as duplicates.
Test matches but response does not run Confirm simulation or responses are activated and the rule references the intended response set.
Unexpected system impact Stop testing and restore the verified working-aurora-core snapshot.

Clean up

Stop test activity, remove harmless artefacts with their documented cleanup commands, review and remove temporary security exclusions that are no longer approved, export the CHG-1042 evidence note, and return the VM to its clean or known-good snapshot.

Where to go next

Return to the Aurora Lite overviewReview the complete journey and preserved proof-of-concept material. Understanding EDRConnect endpoint telemetry, investigation, and response to the wider EDR workflow.
PreviousRansomware detection challengeNextReturn to the Aurora Lite overview