Installing kansa incident response tool

 Kansa is an IR framework.

https://github.com/davehull/Kansa

For enterprise data collection, you need to do this first from the admin system:

Set-NetConnectionProfile -NetworkCategory Private (In private network)

Enable-PSRemoting from powershell on the systems where you want to run this tool.

Check:

netstat -naob | findstr "5985" 

Also allow tcp port 5985 and 5986 for winrm through the network. You can use  GPO. Though winrm is communicating over http and https but authentication will be happened using kerberos in domain environment. 

After downloading it from the github and unzip it, you need to unlock it using powershell. Need powershell v3 or later.

ls -r *.ps1 | Unblock-File

Powershell policy bypass:

Set-ExecutionPolicy AllSigned | RemoteSigned | Unrestricted

From FOR508 course:

.\kansa.ps1 -OutputPath .\Output\ -TargetList .\hostlist -TargetCount 250 -Verbose -Pushbin

-Pushbin is required by those scripts who has dependency of other binary. Kansa will then push that binary to the target systems. -Rmbin to remove that as well.

Those scripts are following:

1. Get-Autorunsc.ps1

2. Get-CertStore.ps1

3. Get-FlsBodyfile.ps1

4. Get-ProcDump.ps1

5. Get-RekalPslist.ps1

If you use the -Pushbin flag then make sure you have copied the above 5 scripts binary (whichever you want) to the .\Modules\bin\ folder.  

Do not do this in production. In production authentication should be kerberos. In lab you can do this to set the auth mode as basic.

winrm set winrm/config/client/auth '@{Basic="true"}'

winrm set winrm/config/service/auth '@{Basic="true"}'

winrm set winrm/config/client  '@{AllowUnencrypted="true"}'

winrm set winrm/config/service '@{AllowUnencrypted="true"}'

Fetch artifacts from single machine:

.\kansa.ps1 -OutputPath .\Output\ -Target localhost or $env:COMPUTERNAME -ModulePath .\Modules\ -Verbose -Authentication basic -Credential (Get-Credential)

You need place the Autorunsc.exe tool in the %SystemRoot% folder to execute the script successfully.

Once the tool finishes it task you will see a folder named Output_timestamp. 

hostlist file must contain one host per line.

If you do not provide hostlist file then the tool will query to AD to fetch the targets. For that you need remote server administration tool to be installed. 

Download RSAT:
https://www.microsoft.com/en-us/download/details.aspx?id=39296

When using AD, you also need to use -TargetCount parameter to limit the query.

Results are converted into tsv format so that it can easily understandable by timeline explorer.

Running module separately:

Modules\Net\Get-Netstat.ps1

.\Get-Netstat.ps1 | ConvertTo-CSV -Delimiter "`t" -NoTypeInformation | % { $_ -replace "`"" } | Set-Content netstat.tsv 

Distributed kansa + fire and forget:

Please check For508 Advanced IR and TH book number 1 pdf 109 page. If you have less than 150 systems then normal kansa.ps1 will suffice. But if you have more than that then you may need to think of kansa distributed script. 

Avi