Introduction to Kansa - PowerShell-based Incident Response

As a continuation of the "Introduction to Windows Forensics" series, this episode covers a powerful, PowerShell-based incident response framework called Kansa. Kansa uses PowerShell Remoting to run user contributed modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline. This framework can be run across a single host, or even tens of thousands of hosts.
We’ll first look at the included modules and run some of them to learn how and what information Kansa collects. Then we'll run the tool against a Windows 10 machine and then analyze the exported CSV data with Timeline Explorer. I think you'll be amazed by the results!
** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. **
🖥 Commands Used in This Episode
Set-NetConnectionProfile -NetworkCategory Private
Enable-PSRemoting
DO NOT USE THE COMMANDS BELOW IN PRODUCTION ENVIRONMENTS
###############################################################
winrm set winrm/config/client/auth '@{Basic="true"}'
winrm set winrm/config/service/auth '@{Basic="true"}'
winrm set winrm/config/client '@{AllowUnencrypted="true"}'
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
###############################################################
.\kansa.ps1 -Target localhost -ModulePath .\Modules -Verbose -Authentication basic -Credential (Get-Credential)
Kansa (GitHub):
github.com/dav...
Download Eric Zimmerman's Tools:
ericzimmerman....
If you're new to PowerShell Remoting, check this out:
www.networkadm...
Background Music Courtesy of Anders Enger Jensen:
/ hariboosx
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics

[@davidelsliger2819]

Just got finished covering this in SANS SEC511. Nice framework for DFIR on Windows.

[@javalireports2209]

Thanks for making this video.
Would you please make a video on enterprise level running these scripts?
For example: you can consider couple of VMs (hosts) > run the scripts > "analyse output collected from multiple hosts from single file"

[@anthonyc7407]

Great job as usual! This helped compliment some of my SANS 508 material.

[@BigstickNick]

Im looking for ways to continue it as well

[@EnglishRain]

Thank you, please continue to make videos like these, love your work!

[@terra7477]

Hello, I'm finishing my studies as SysAdmin and I have to do a little job, I've been assigned to do one about Kansa and this video have been very helpful to fully understand how it works. ty very much and greetings from Canary Islands!

[@ssnkhan]

Is Kansa abandonware? It was featured heavily in SANS FOR508, but it seems the project hasn’t seen any updates in two years.

[@13Cubed]

It seems that way, sadly. But, at least the framework can be easily adapted as you need and can still prove to be quite useful.

[@davidcollins4489]

Absolutely! Great video. I've used Kansa in the past.
I'd love if you could cover aggregating and analyzing outputs from multiple hosts.!!!

[@hassanshehata9626]

Good work, just finished the whole playlist and it was very informative.

[@hirich008]

Your content are always helpful. Thanks for the video.

[@ilyasamarov]

Thanks for this amazing intro course. learned many new things :)

[@fam-jam4531]

amazing, thanks for this Video!!!

[@gaurav572684]

Great..I would love to see more videos on Kansa.

[@nios1515]

My favorite channel in youtube. Thank you!

[@blablabla-es3xv]

Please make a video on Skadi tool

[@SethTech]

You guys are awesome. Keep it up!

[@sulthansk6444]

Thanks for the video...

[@Manavetri]

Great tool !

[@andrewhughes3866]

Great stuff!

[@HitemAriania]

Great stuff! But as soon as this runs in a enterprise it askes for Remote Administration for AD to be installed - which we can not do on isolated and hosts that are not suppose to have it.

[@zev1515]

Subscribed!