Aurora Light: Exploring Detection Engineering and Sigma Rules

Aurora agent enables effective detection engineering and customizable threat monitoring for cybersecurity enthusiasts.

### Exploring Aurora: A Deep Dive into Detection Engineering
* 🔍 In this video, we take a quick look at the **Aurora agent from Nextron Systems**, focusing on its capabilities for **detection engineering** and how to **utilize it effectively**.
* 💻 Aurora is an endpoint detection and response (EDR) platform that operates based on **Sigma rules**, allowing users to **detect malicious activities** on their systems.
* 📚 The Aurora agent user manual provides comprehensive documentation on setup and installation, including options to **run with a dashboard feature** for a **more interactive experience**.
* 📊 By accessing the Sigma rules, users can explore various detection capabilities, including those targeting **suspicious child processes** created by PowerShell.
* 🛠 The video showcases how to manipulate and customize Sigma rules to enhance detection efforts, emphasizing the **importance of real-time monitoring** in identifying potential threats.
* 🎉 Additionally, the video highlights the upcoming **SOC Analyst Appreciation Day**, encouraging viewers to support those working in security operations centers who play a **critical role in cybersecurity defense**.
* 📅 Viewers are invited to participate in the appreciation day, which offers **career-focused sessions and insights into the cybersecurity field**, while also learning how to **effectively use Aurora for detection engineering**.
* 🚀 Overall, the video serves as an introduction to **Aurora's functionalities** and sets the stage for future exploration into **crafting custom detection rules** and **improving cybersecurity practices**.

you're going to get hacked. You know there's a thing that we say in cybersecurity across the industry: it's not a matter of if, it's a matter of when. Because you will be compromised at some point, whether some software that you're running is vulnerable, maybe you fell for a phishing link, or you clicked on something that you shouldn't have. It just happens, and you can't always rely on prevention or preventative measures to stop it. Hey, antivirus, maybe you just turn that on and forget it. Sometimes it misses, so you also need to blend in some detection capabilities in finding and seeing the threats so that you can then respond and do whatever cleanup remediation you have to. So, in this video, I'd love to kind of open the door for us to maybe explore soon enough some detection engineering, and the way that we can do that is super easy. So, here I am on my computer, and I'm going to go over to Firefox, open up the web browser, and I just want to search for the Aurora light. Here we go, there's the

result I'm looking for Aurora agent from Nextron Systems. Now, Aurora is an example of an EDR or an endpoint detection and response platform. Yep, fine, you can take my cookies, I don't care. The thing is, Aurora is based on Sigma rules, and these are these rules that we've talked about before, or at least will be very, very soon, on how you can detect or look for and hunt for malicious activity and bad things happening on your computer. One of the coolest things is that Aurora is completely transparent and fully customizable because you can change and manipulate the Sigma rules under the hood that it might try to detect or flag things off of. Doesn't really use a whole lot of bandwidth or storage across your network, and it's all on-premise. Like, you could literally run this on your virtual machine or on your computer or whatever you want and just kind of play. And to be honest, for our purposes of a YouTube video and maybe a series on education of detection engineering, look, there's a free version with Aurora Light where we

can play with any of these Sigma rules and maybe learn some detection engineering in my mind. That is the best part, and that is why I thought, Hey, that would be perfect for a little bit of a sandbox, a playground environment for us to learn, learn, and get some education in. We can kind of kick the tires, see what Aurora does out of the box, and then maybe try to set up our own Sigma rules, maybe start with a clean slate, and try to craft and create some detection efforts that, Hey, we just build out on our own. And let me say, Aurora is put together by Nextron Systems, and you might be familiar with a lot of their other stuff, like Thor or other maybe open-source and freely accessible tooling, all offered by the great folks over at Nextron Systems. And they're kind of champion Florian Roth. I'm sure you're familiar with a lot of his great work over on the internet for cyber threat intelligence and tracking adversaries. Great stuff there, kudos for credit is due. This is all big thanks to Floran and

nextron systems, but let me showcase Aurora Light, the free Community Edition that you can just go ahead and download, grab off the internet here, click on download Aurora Light. The only thing that you need to enter here for the free edition is just a name and email address that they'll send you the download to, super quick and easy. You'll get an email to confirm, and once you've confirmed, you'll receive another email with the personal license file and the download link for Aurora Light. Here it is, we can click on download your license and download Aurora Light and get these on our computer. I am downloading for Windows here. They include the SHA-1 hash so you can do a little like integrity check, validate the download here, cruise through the end-user license agreement, and with that, we can download. All right, so in my downloads directory, I have this ZIP archive. I can go and extract all here, just leave that in, I don't know, maybe our desktop, that's fine. We'll put it in just an Aurora folder here, and what I'm going to do is just

copy and paste this license file and put it in the same directory. Here we'll open that folder up and I'll just paste it in and I think that should be good. I'll close these windows and I'll open up a terminal here, just the command prompt so that I can move into my desktop. I'll CD into desktop and move into the Aurora directory that we've created. We have all of this stuff here but of course the Aurora agent 64-bit executable that we want to fire off. So let me just do /Aurora agent 64bits. I'll hit enter and okay hey do you want to allow this app to make changes to your device. Sure thing this will protect my computer and hey get a little bit more of that detection and response in action. Let's hit yes and Aurora light is firing up. Takes just a moment to get things loaded. It's going to be cruising through all of those different Sigma rules and now hey Aurora is doing its thing. Look we can keep kicking the tires in just a second but I do want to drive

the point home seriously. You listening in whether your organization, business, company, whatever. I don't know. Look, doing this in one way, in any way, shape, or form, hooking up some events that you might be tracking, some information and telemetry that you could get and pour over into a SIEM or an SEM, the Security Information Event Management thing, getting that SIEM or SIM, whatever, however you want to pronounce it, getting that actually put together and building out this detection capabilities. You could probably, like, pretty likely, practically prevent, like, almost 60 to 70, maybe even higher, of the incidents and breaches that still happen in today's world. It's all a matter of getting folks actually taking a look at the event, you know, like a SOC or a Security Operation Center, and SOC analysts, great folks that are always cruising through that. Hey, they need a little bit of love, and seriously, they do great work. If you don't mind, I'd love to tell you about something that our great friends over at DVO are doing to celebrate and appreciate those security.

operations center analysts and hey all of us in the industry doing great work to better cyber security sock analyst Appreciation Day Security operation Center analysts are always in the trenches they fight on the front lines for cyber security defense and oftentimes it's a thankless job they are the unsung heroes of our industry so to help celebrate these Champions dvo is hosting the third annual sock analyst Appreciation Day a completely free event on October 18th dvo established the sock analyst appreciation day to give some long overdue kudos to Sock analysts and encourage organizations to improve job satisfaction and mental well-being packed full with career-focused sessions like finding your role in Niche digging into automation transitioning from public sector to private sector cyber security work and so much more I'll be speaking on the rapid response efforts during the 3cx supply chain compromise and I'd love to see you there if you're a current Security operation Center analyst or you're fascinated by the work and you want to become one you should

Absolutely tune into the sock analyst appreciation day. It's completely free and a day dedicated to celebrate you and your great efforts. Sign up for the sock analyst Appreciation Day on October 18th with my link below in the video description jh. slock. Huge thanks to dvo for sponsoring this video. Okay, so Aurora light is up and running on our computer. And look, let's just kind of play pretend. Let's say that I am an adversary, I'm a threat actor, I'm a hacker. I've compromised this computer, and maybe I can just do anything I want now. I've got control over it with like a reverse shell or commanding control, some implant or Beacon. And say that I was running from the command line, just the usual immediate quick and easy enumeration. Hey, what user am I? Who did I land as with the shell that I want to be interacting with? Who am I? Let me run this, and you'll note, ooh, okay, uh, couple of entries already firing off from Aurora. Now, this is small, simple, hey, just in the

text here, but wouldn't it be nice if we got a little bit better notification for that or we could dig into it? Yeah, yes, exactly. So look, honestly, I'm going to hit control C, and I'm going to close Aurora, and I'm going to try and run that again, but I want to use some other little command line arguments or other things that we could do here. I think Tac H will show me the help. No, maybe we could just go ahead and check out the documentation online. Here it is. This is the Aurora agent user manual, and you could kind of dig into all the stuff here to get it spun up, get it installed, just as we did. But the Aurora agent dashboard, that seems kind of neat. I do want to be able to dig into that so we have more of an interface, and we can see stuff happening rather than just in that simple command line. Aurora can be started or installed with a dashboard feature using the dash dash dashboard flag. Saying Dash three times was kind of weird. Dashboard can be accessed with

whatever web browser going to port 17494, and with that, we could change or manipulate some of the notifications or any of the other settings that we might like. So, let's try that. Let's try to run our Aurora agent 64-bit with TCT Tac dashboard. And the moment I fire that up, we should be able to see, Hey, Aurora's fired up, and Ooh, we get a little notification, the Windows balloons or the toast that it shows, 'Hey, Nextron Notifier is started.' And now we could go navigate in our web browser to the dashboard that was on what? Local Host? Yeah, 17494. Now, this is Aurora running in the current context, like the current session of this invoked rendition and runtime of Aurora, right? So, we don't see the Hami command that we had just a moment ago, but here we could see all of the flagged rules or the detection of events that we saw. And we could, I don't know, dig into the settings, the status, if you wanted to change any of these configuration values.

for the notifications, you totally could, of course, find the documentation and hey, maybe grab the full version if you would like to. But look, let's say I'm more of a sophisticated hacker now and look, I'm going to use some of those living off the land techniques or lull bins, living off the land binaries or L Bass with scripts and other libraries. And let's try to use something a little bit more shady or nefarious other than then who am I, right? We could do, I don't know, something simple again as a proof of concept, like just fire up in the calculator or the command prompt or some process that may might want to start. But at least we can Maser it or hide it, let it blend in a little bit by trying to use some other utility to proxy it. I'll use script Runner because this is super quick and easy, and we just go ahead and execute whatever we want underneath script Runner. This should be able to get maybe some notifications here for us because we can go see what

rule or even what Sigma rule is actually going to see this. Let's minimize this, get back to a command prompt, and let me just, I don't know, we could paste this in where we run calc.exe. Does this fire for one thing? Yes, it does. And take a look, potentially suspicious Powershell child. Ooh, because we got to run script runner. Exe out of Powershell. Let's close out the calculator and let's go view that event over in our dashboard. Let me toggle back over here to the dashboard and take a look. Sigma did find this event fire. We drill down into this. There is a potentially suspicious Powershell child process. 'Cause we hey fired up something weird. Now the cool thing is it gives us all of the resources that tell us what fired here and how we could go dig into this Sigma Rule and like where it actually exists inside of our installation of Aurora. Let me copy this path and let's get back to our file explorer because in the desktop on that Aurora directory that we created, we could actually go into maybe taking a

look at some of the signatures here. Here we can go into the sigma rules, and then in this public directory, we know we'll start to fall down the sort of path in the file system that tells us which of these actually are in action. Let me go toggle the location here. I'll just paste in that path for our public so we can drill down into the specific one under Windows process creation, proc creation, wind Powershell suspicious child process. Let's remove that file name here, but let's just go see all of the potential Sigma rules that could be ran here. Take a look at all these kind of tagged with lull bins, with those living off those land techniques, and this is just like the open-source data set. Now let's try and filter that down to just the rule that fired our process creation, wind Powershell suspicious child process. Can I go ahead and open that? Let's use Sublime Text just to see that in a text editor with the yaml syntax highlighting, and take a look. This is the sigma rule that fired potentially suspicious child.

process yep hey we've got a little uh note here for the description, maybe an ID, experimental status, and maybe a reference as to where this was flagged, and some miter attack techniques if you're tracking a lot of the miter attack uh kind of vernacular and terminology here. So, this is the detection logic. We're going to try to select and build the criteria out for the image, the parent image, right, the process ID, or the process that ran, whether it's powershell.exe, maybe isse for that integrated scripting environment, and whatever process the image flag, the field set for the process name, and the command line actually ends with, whether it's BH bits admin, CT util, or any of these. You can see our script Runner executable is in that list. And of course, the condition here, hey, we do want to check in any of the selection criteria, and maybe some other optional filters that we're going to be tracking. The question is though, this LOL basing, did we actually see this in action? The one that Lins recommended, they suggested.

with here is this actually present in our set. I think it is. Let me go ahead and search for this. Let me paste that into the search bar here. But it doesn't exist. What about I don't know higher than this. Oh shim database is firing off something weird is going on. By the way, not to completely derail, but I think that's one of the coolest things. You also get a little bit of visibility to when you're just like using your computer. You can see some of the stuff that just naturally happens on Windows. And then you get a little bit more of the security research. I don't know, maybe intuition in there and explore different things that just happen. Let me go up to a higher directory. If I just search for this yaml file. No, even in like I. Let's go to the very, very top of Aurora. That doesn't exist. So could we just create this? Like we could copy and paste this and go put this into Aurora's rule set. But look, let's dig into some of this logic here because the selection component is

actually checking if the parent process is serve you. Maybe that's a little bit more specific to some specific threat, like hey, threat actors targeting solar wind software with some exploit chain. Maybe that's not what we just got to fire off, but it does look like the actual process could end with script Runner, so maybe that isn't exactly what we want here. But we could tweak this, like we could manipulate this, we could write our own, and maybe even build out as many as we want of these like living off-the-land binaries and small Sigma rules to be able to detect them. And if we actually dig more into the documentation of Aurora, then look, maybe we could manipulate or change what rules are actually at it or what configuration is set, or maybe running Aurora as a service so it's in the background and you don't have that foreground little command prompt there. But if we did want to start to write our own rules for Sigma, we could dig into the Sigma repository again, totally free, available online on the open internet, on GitHub, and we could

Hey, go figure out that syntax, maybe kind of baseline off of the other rules that exist, and see how we could get started writing our own rules. Now, we could just do small, simple stuff like this is just kind of our own educational exploratory sandbox and playground. But if we were to try to, hey, play with these rules, could we actually detect our invocation of Script Runner? If we drill down into the Sigma specification, we might be able to go see, hey, what do we need to actually refer to the arguments that are included in the command line? But I think that is a fine enough cliffhanger because at least now we've kicked the tires on Aurora, got it set up, and now we can start to write our own Sigma rules. But now we've got a real-time environment in a virtual machine that we can just test rapidly in the moment, see, hey, will our activity, will this behavior, will this threat, like a real actor, threat actor, hacker, and adversary, could that be something that we could see in the environment? I'm really excited about.

different videos maybe along that idea like hey we could roll through L bins, craft our own canvas of detection engineering rules and rule sets, or maybe I don't know, start to look through the DF report, the defer report. Maybe we could look through new write-ups or threat intel and analysis shared by tons of vendors out there. Like we could have a whole lot of fun, and I hope you are enjoying that sort of material and content. A little bit of blue team, a little bit of defense, a little bit of detection engineering. And with that, hey, kudos for credit is due, Nextron Systems in Aurora and Florian in the mix here. And also please, if you'd like to support and maybe give some love and support to those SOC analyst Security Operation Center folks that do this work day in and day out, tracking these alerts and notifications, seeing what detection rules fire. Please go take a look at D's SOC Analyst Appreciation Day link in the video description, and I'm excited to go give a little bit of a presentation there. I hope that'll be fun, so hope you

enjoyed this video. Little quick dip in our toes in the water for detection inuring, and we'll do more soon. Thanks for watching. See you in the next video.

Detect Hackers & Malware on your Computer (literally for free)

Free Cybersecurity Education and Ethical Hacking.

John Hammond

The license file for Aurora needs to be copied to the same directory as the executable.

The Aurora agent is then launched from the command prompt, with the process of loading Sigma rules and detecting threats.

The video discusses the importance of blending prevention and detection capabilities in cybersecurity and offers a glimpse into exploring detection engineering.

Aurora Agent and SOC Analyst Appreciation Day

The Aurora agent is running on port 17494, allowing manipulation of notifications and settings through a web browser.

The dashboard displays flagged rules and event detections, emphasizing the importance of tracking and managing security events to prevent incidents and breaches.

DVO is hosting the third annual SOC Analyst Appreciation Day on October 18th, offering free career-focused sessions to celebrate and support security operation center analysts.

The demo involves running a potentially suspicious PowerShell child process, which is flagged by Sigma rules in the Aurora installation.

The presenter explores the Aurora directory for detection engineering resources and emphasizes the importance of supporting SOC analysts.

The detection logic is outlined, focusing on criteria such as the image, parent image, process ID, and command line to identify suspicious activities.

Exploring Aurora Light: A Free Community Edition

Aurora Light offers a free Community Edition for download, requiring only a name and email address for access.

The software provides visibility into system activities and security research, making it a valuable tool for users.

The download includes a SHA-1 hash for integrity verification and offers a personal license file upon confirmation.

Exploring Aurora: An EDR Platform for Sigma Rule Detection

Aurora, from Nextron Systems, is an endpoint detection and response platform based on Sigma rules for detecting malicious activity.

The platform is transparent, customizable, and can be run on a virtual machine or computer, making it a great sandbox for learning detection engineering.

Aurora offers a free version, Aurora Light, allowing users to play with Sigma rules and build their own detection efforts.

The video provides a brief overview of using the Aurora agent for detection, highlighting the importance of better notifications and a user-friendly interface.

The Aurora agent can be started with a dashboard feature for easier navigation.

The video also explores Sigma rules and living off the land techniques, demonstrating how to use them for potentially suspicious processes.