Threat detection
for Windows networks

Someone signs in to one machine after another over RDP

A user is added to the Domain Admins group

Someone turns off Defender on a workstation

Someone requests service-account tickets to crack their passwords offline (Kerberoasting)

The Security event log is cleared

A new service is installed on a domain controller

Each of these leaves a record in the Windows event logs. Arden collects those logs and alerts when it recognizes activity like this.

Arden is a single executable that runs on your own Windows machine or server, with no database or runtime to install. It reads Windows event logs, from that machine or from agents on your other machines, and raises alerts for attack techniques mapped to MITRE ATT&CK. It only detects and alerts, so keep your antivirus or EDR running.

Kill Chain Coverage

Attack techniques Arden detects, by MITRE ATT&CK tactic

Attack tools and malware change all the time, but the steps of an attack stay the same: an attacker signs in with stolen credentials, gains administrator rights, moves to other machines, sets up a way back in, turns off defenses, and then deploys ransomware or takes data. Arden's rules look for those steps in your Windows logs, grouped below by MITRE ATT&CK tactic. Each alert names the step, the machine and the account involved, so your IT team can check it quickly and shut it down if nobody can explain it.

Discovery

Admin group enumeration, network share discovery, sensitive group membership queries, directory service access

Execution

PowerShell obfuscation, encoded commands, suspicious process chains, WMIC execution, script interpreter abuse

Persistence

Scheduled tasks, new services, registry run keys, account creation, group membership changes, startup modifications

Privilege Escalation

Suspicious service installs, special privilege assignment, token manipulation, named pipe impersonation

Defense Evasion

AV/EDR disabling, firewall tampering, log clearing, timestomping, audit policy modification, AMSI bypass

Credential Access

Kerberoasting, AS-REP Roasting, DCSync, NTDS.dit extraction, LSASS access, credential dumping, DPAPI abuse

Lateral Movement

Pass-the-Hash, RDP pivoting, WMIC/DCOM, PsExec, remote service creation, explicit credential logon from remote IPs

Impact

Shadow copy deletion, recovery disabling, ransomware precursor command patterns

Noise Filtering

How Arden keeps false alarms down

A normal Windows network logs plenty of activity that looks suspicious at first glance. Arden's rules leave out common activity that is known to be harmless. You will still see some false positives, and you can suppress an alert and record the reason.

Built-In Resilience

What happens when an attacker tries to hide

Attackers often try to cover their tracks by clearing logs or switching off security tools. These features help make sure you still have a record when that happens.

Emergency Log Preservation

When the Security or System log is cleared, Arden raises an alert. Events it has already collected are stored on the Arden server, so clearing the log on an endpoint doesn't remove them. If the log is cleared on the Arden server itself, Arden also writes its alerts and events to a separate preservation file.

Actor Attribution

For detections such as Defender being disabled or a firewall rule being changed, Arden tries to work out which user account made the change, looking beyond the standard subject fields where needed. The logs don't always record it, so this isn't always possible.

Alert Grouping

Repeated alerts from the same rule are grouped into one row. For example, 57 RDP connections to the same server show as a single alert with the time range and event count, and you can expand it to see each individual event.

No Extra Infrastructure

Arden is one executable with no database or runtime to install. It runs on Windows 10/11 or Windows Server 2016 and later (x64) and reads the event logs Windows already keeps.

Fewer Alerts From Windows Accounts

Windows records many non-human identities, such as machine and service accounts, in its user fields. Arden recognizes them, so you have less to tune by hand.

MITRE ATT&CK Mapped

Each detection rule is tagged with the MITRE ATT&CK technique it looks for and a severity level. Arden also supports Sigma rules if you want to add your own.

Detection Highlights

Examples of what Arden detects

A few of the built-in detections. The rules were tested against recorded attacks and against normal Windows activity to cut down false positives, though you should still expect some.

Defender / AV Disabled

Alerts when real-time protection is turned off through PowerShell, the service controller, a registry change or Group Policy, and names the user account when the logs show who did it.

T1562 · Defense Evasion

Remote Lateral Movement

Flags explicit-credential logons from remote IPs, the pattern left by WMIC, DCOM, PsExec and similar tools. Repeated alerts are grouped into one entry you can expand, rather than dozens of identical ones.

T1021 · Lateral Movement

Kerberoasting & AS-REP Roasting

Looks for Kerberos service ticket requests (event 4769) that ask for RC4 encryption, which attackers prefer because the tickets are easier to crack offline.

T1558 · Credential Access

Pass-the-Hash via NTLM

Flags network logons that use NTLM authentication, which is how pass-the-hash usually shows up in the logs. Machine accounts and service identities that normally use NTLM are excluded.

T1550.002 · Lateral Movement

PowerShell Log Inspection

Checks the PowerShell script block, module and operational logs for obfuscation, encoded commands, AMSI bypass attempts and credential-harvesting scripts.

T1059.001 · Execution

DCSync & NTDS.dit Access

Detects DCSync replication requests and access to the NTDS.dit database, the two common ways of pulling password hashes out of Active Directory. Domain controller machine accounts doing normal replication are excluded.

T1003.006 · Credential Access

Shadow Copy Deletion

Detects commands that ransomware commonly runs to block recovery, such as deleting volume shadow copies, wiping the backup catalog or turning off Windows recovery. These alerts are raised as Critical.

T1490 · Impact

Anti-Forensics Detection

Covers clearing of the Security log, audit policy changes, timestomping and trace-removal commands, with the user account where the logs record it. Clearing the Security or System log also triggers the automatic export described above.

T1070 · Defense Evasion

Alert Grouping

Repeated alerts are grouped

Grouped alerts keep every original event. Expand a grouped row in the dashboard to see each alert with its timestamp, event ID, source IP and full details.

Before: 57 identical alerts

Regular RDP use can produce a lot of connection events. Without grouping, each one becomes its own alert, and anything else that fired that day is easy to miss in the list.

14:32:19 MED RDP Authentication

14:32:51 MED RDP Authentication

14:33:26 MED RDP Authentication

14:34:35 MED RDP Authentication

14:47:06 MED RDP Authentication

... 52 more identical alerts ...

Apr 28 14:32

MED RDP Authentication 57 3 endpoints

Lateral Movement · 3 endpoints affected · Mar 14 15:42 – Apr 28 14:47

▾

▾ SRV-DC01 31 alerts

▸ SRV-FILE02 18 alerts

▸ WS-ADMIN07 8 alerts

After: 1 grouped alert with drill-down

The same 57 alerts show as one row with the count, severity, tactic, number of affected endpoints and time range. Expand it to see a per-host breakdown, then open any individual alert.

Network Edition

Monitoring more than one machine

The Network edition runs Arden on one machine and installs an agent, as a Windows service, on each machine you want to watch. Agents send their logs only to the Arden machine, and all alerts appear in its dashboard.

Agent Deployment

Run a network discovery scan from the dashboard, select the machines you want, and deploy the agent over WinRM with an admin account. The dashboard then shows each host's agent status.

Email & Webhook Alerting

Arden can send alerts by email or to a webhook. You set the minimum severity that triggers a notification.

Cross-Endpoint Grouping

When the same rule fires on several machines, the alerts are grouped into one row with a per-endpoint breakdown, so you can see which hosts are affected.

Threat detection for Windows networks