Aurora Lite

Aurora Lite is a free Windows Endpoint Detection and Response tool from Nextron Systems. It monitors Windows activity through Event Tracing for Windows, evaluates Sigma rules and Indicators of Compromise, records detections, and can perform configured response actions.

This section preserves the original proof-of-concept procedures and screenshots while organising them into shorter, outcome-focused journeys similar to the Splunk guide.

What Aurora Lite does

CollectObserve selected Windows activity through ETW event sources.

DetectMatch Sigma rules, IOCs, and configured warning signs.

InvestigateReview the matching event, process, user, file, and network context.

RespondSimulate, suspend, terminate, or run a carefully tested custom action.

Use an isolated, recoverable lab

Response actions can interrupt legitimate processes, while the ransomware challenge involves live malware. Begin with harmless function tests and a reversible Notepad response. Use the advanced challenge only with specialist malware-handling controls, authorisation, isolation, and clean snapshots.

Choose your journey

01Install and verify Prepare Windows, obtain the package and licence, install the dashboard, and verify service health. Complete when the service, signatures, dashboard, and baseline are healthy. Beginner · Windows VM · 20–30 min

02Configure and maintain Choose a preset, manage signatures, control exclusions, update safely, and preserve rollback. Complete when the configuration fits the lab and a known detection still works. Beginner · Administrator access · 30–45 min

03Test and investigate Generate controlled process, network, file, registry, IOC, and LOLBAS activity. Complete when you can connect the test action to the resulting Aurora record. Intermediate · Isolated lab · 30–45 min

04Configure a response Review response flags, inline rules, response sets, and a reversible Notepad test. Complete when the bounded action triggers only for its intended rule. Intermediate · Restorable VM · 30–45 min

05Ransomware challenge Study the preserved WannaCry proof of concept as an advanced detection-and-response capstone. Complete when evidence is retained and the VM is restored to its clean state. Advanced · Specialist controls · 45–60 min

06Go hands-on Choose the browser simulation or reproduce a safe workflow on an authorised Windows lab. Complete when you can explain and document a supported disposition. Beginner onward · 15 min–multi-hour

How endpoint activity moves through this PoC

1 Windows activity→ 2 ETW event stream→ 3 Sigma or IOC match→ 4 Aurora event→ 5 Review or response

Lab architecture

The preserved proof of concept used Aurora Lite on a Windows Server 2019 VM behind a FortiGate lab firewall. Adapt addresses consistently and use supported Windows and Aurora releases for a new build.

Host	Demonstrated platform	Role	Demonstrated address
FortiGate	FortiOS 7.6.0	Lab firewall and router	192.168.1.111 WAN / 10.0.0.1 LAN
WS2019	Windows Server 2019	Aurora Lite endpoint	10.0.0.140

New to Aurora Lite?

Start with the interactive lab, then complete the harmless installation and function-test journeys before enabling responses.

Preserved proof-of-concept material

The original procedures, command examples, observations, response configuration, and screenshots are arranged within the relevant journeys: installation material is under Install, signature and removal guidance is under Configure, function tests are under Test & investigate, and the response demonstrations are under Respond and Ransomware challenge.

Continue with a journey

Install Aurora LitePrepare the package, licence, dashboard, and baseline.Run a function testGenerate controlled activity and inspect the detection.Go hands-onUse the browser lab or complete the self-hosted challenge.