Threat detection
for Windows networks

If someone was moving between your machines over RDP right now, could you see it?

If a user was added to the Domain Admins group last Tuesday, would you know?

If someone disabled Defender on a workstation this morning, could you tell who did it?

If Kerberoasting was used to harvest service account credentials overnight, would it show up anywhere?

If your Security event log was cleared five minutes ago, would you still have a copy of what was in it?

If a new service was installed on a domain controller at 3 AM, would anyone notice?

Each of these leaves a record in the Windows event logs. Arden collects those logs and alerts when it recognizes activity like this.

Arden is a single executable that runs on your own Windows machine or server, with no database or runtime to install. It reads Windows event logs, from that machine or from agents on your other machines, and raises alerts for attack techniques mapped to MITRE ATT&CK. It only detects and alerts, so keep your antivirus or EDR running.

Kill Chain Coverage

Attack techniques Arden detects, by MITRE ATT&CK tactic

The detection rules are grouped under the eight ATT&CK tactics below. Against the public EVTX-ATTACK-SAMPLES corpus, Arden raised at least one alert on 233 of the 278 recorded attacks (84%). It won't catch everything, so an empty alert list doesn't prove nothing happened.

Discovery

Admin group enumeration, network share discovery, sensitive group membership queries, directory service access

Execution

PowerShell obfuscation, encoded commands, suspicious process chains, WMIC execution, script interpreter abuse

Persistence

Scheduled tasks, new services, registry run keys, account creation, group membership changes, startup modifications

Privilege Escalation

Suspicious service installs, special privilege assignment, token manipulation, named pipe impersonation

Defense Evasion

AV/EDR disabling, firewall tampering, log clearing, timestomping, audit policy modification, AMSI bypass

Credential Access

Kerberoasting, AS-REP Roasting, DCSync, NTDS.dit extraction, LSASS access, credential dumping, DPAPI abuse

Lateral Movement

Pass-the-Hash, RDP pivoting, WMIC/DCOM, PsExec, remote service creation, explicit credential logon from remote IPs

Impact

Shadow copy deletion, recovery disabling, ransomware precursor command patterns

Noise Filtering

How Arden keeps false alarms down

A normal Windows network logs plenty of activity that looks suspicious at first glance, such as virtual service accounts logging on, drivers loading at boot, OEM updaters and authentication brokers. Arden's rules exclude known-benign patterns like these. You will still see some false positives, and you can suppress an alert and record the reason.

3,174

Raw Security Events

EID 4624 Logons EID 4672 Privileges EID 7045 Services EID 4648 Explicit Creds EID 1024 RDP

→

Alerts

2 Critical 1 High 3 Medium 1 Low

Built-In Resilience

What happens when an attacker tries to hide

Attackers often try to cover their tracks by clearing logs or switching off security tools. These features help make sure you still have a record when that happens.

Emergency Log Preservation

When Arden sees the Security or System log being cleared, it raises an alert and automatically exports its alerts and events to a file on the Arden server's disk. Clearing the log on the endpoint does not remove what Arden has already collected.

Actor Attribution

For detections such as Defender being disabled or a firewall rule being changed, Arden tries to work out which user account made the change, looking beyond the standard subject fields where needed. The logs don't always record it, so this isn't always possible.

Alert Grouping

Repeated alerts from the same rule are grouped into one row. For example, 57 RDP connections to the same server show as a single alert with the time range and event count, and you can expand it to see each individual event.

No Extra Infrastructure

Arden is one executable with no database or runtime to install. It runs on Windows 10/11 or Windows Server 2016 and later (x64) and reads the event logs Windows already keeps.

Virtual Account Handling

Windows records GUIDs, SIDs, machine accounts and service identities in its user fields. Arden recognizes 12+ categories of these non-human identities and leaves them out of detections where they would only add noise, so you have less to tune by hand.

MITRE ATT&CK Mapped

Each detection rule is tagged with the MITRE ATT&CK technique it looks for and a severity level. Arden also supports Sigma rules if you want to add your own.

Detection Highlights

Examples of what Arden detects

A few of the built-in detections. The rules were tested against recorded attacks and against normal Windows activity to cut down false positives, though you should still expect some.

Defender / AV Disabled

Alerts when real-time protection is turned off through PowerShell, the service controller, a registry change or Group Policy, and names the user account when the logs show who did it.

T1562 · Defense Evasion

Remote Lateral Movement

Flags explicit-credential logons from remote IPs, the pattern left by WMIC, DCOM, PsExec and similar tools. Repeated alerts are grouped into one entry you can expand, rather than dozens of identical ones.

T1021 · Lateral Movement

Kerberoasting & AS-REP Roasting

Looks for Kerberos service ticket requests (event 4769) that ask for RC4 encryption, which attackers prefer because the tickets are easier to crack offline. The encryption type is matched whether Windows logs it as hex, padded hex, decimal or a cipher name.

T1558 · Credential Access

Pass-the-Hash via NTLM

Flags network logons that use NTLM authentication, which is how pass-the-hash usually shows up in the logs. Machine accounts and service identities that normally use NTLM are excluded.

T1550.002 · Lateral Movement

PowerShell Log Inspection

Checks the PowerShell script block, module and operational logs for obfuscation, encoded commands, AMSI bypass attempts and credential-harvesting scripts.

T1059.001 · Execution

DCSync & NTDS.dit Access

Detects DCSync replication requests and access to the NTDS.dit database, the two common ways of pulling password hashes out of Active Directory. Domain controller machine accounts doing normal replication are excluded.

T1003.006 · Credential Access

Shadow Copy Deletion

Detects commands that ransomware commonly runs to block recovery, such as deleting volume shadow copies, wiping the backup catalog or turning off Windows recovery. These alerts are raised as Critical.

T1490 · Impact

Anti-Forensics Detection

Covers clearing of the Security log, audit policy changes, timestomping and trace-removal commands, with the user account where the logs record it. Clearing the Security or System log also triggers the automatic export described above.

T1070 · Defense Evasion

Alert Grouping

Repeated alerts are grouped

Grouped alerts keep every original event. Expand a grouped row in the dashboard to see each alert with its timestamp, event ID, source IP and full details.

Before: 57 identical alerts

Regular RDP use can produce a lot of connection events. Without grouping, each one becomes its own alert, and anything else that fired that day is easy to miss in the list.

14:32:19 MED RDP Authentication

14:32:51 MED RDP Authentication

14:33:26 MED RDP Authentication

14:34:35 MED RDP Authentication

14:47:06 MED RDP Authentication

... 52 more identical alerts ...

Apr 28 14:32

MED RDP Authentication 57 3 endpoints

Lateral Movement · 3 endpoints affected · Mar 14 15:42 – Apr 28 14:47

▾

▾ SRV-DC01 31 alerts

▸ SRV-FILE02 18 alerts

▸ WS-ADMIN07 8 alerts

After: 1 grouped alert with drill-down

The same 57 alerts show as one row with the count, severity, tactic, number of affected endpoints and time range. Expand it to see a per-host breakdown, then open any individual alert.

Network Edition

Monitoring more than one machine

The Network edition runs Arden on one server and installs an agent, as a Windows service, on each machine you want to watch. Agents send their logs only to that server, and all alerts appear in its dashboard. We have tested it with 50+ endpoints and designed it for up to 250.

Agent Deployment

Run a network discovery scan from the dashboard, select the machines you want, and deploy the agent over WinRM with an admin account. The dashboard then shows each host's agent status.

Email & Webhook Alerting

Arden can send alerts by email or to a webhook. You set the minimum severity that triggers a notification.

Cross-Endpoint Grouping

When the same rule fires on several machines, the alerts are grouped into one row with a per-endpoint breakdown, so you can see which hosts are affected.

Threat detection for Windows networks