Baltimore Spring 2017

Real World Enterprise Incident Response w/ Kansa

• Robert Adams, Master's Degree Candidate
• Tuesday, April 25th, 8:15pm - 8:55pm

Thanks to its nearly universal availability and tools like Empire and PowerSploit, attackers are increasingly adopting PowerShell to move around corporate networks; shouldn't your defenders have tools to help them leverage the same benefits when hunting them?

Kansa is an open-source incident response framework, written in PowerShell, designed to empower blue teamers to expedite response efforts. The framework provides a platform to collect forensic data from multiple machines across your environment in parallel and the included modules cover many of the most common artifacts left behind by initial compromise, lateral movement, persistence, staging, and exfiltration. It is also infinitely customizable and extensible to meet the needs of a specific investigation since the entire tool is open source and written in PowerShell. This talk will touch on the basic architecture of Kansa, then dive into specific case studies detailing its use in both workstation and datacenter environments.

Speaker Bio: Robert is a Security Analyst at Microsoft. He is extraordinarily passionate about automation, and loves tackling complex problems with a variety of tools, including PowerShell. Robert's career was jump-started in 2006 when he joined the Navy as a Cryptologic Technician. Robert is a Master's Degree candidate in SANS Technology Institute's Information Security Engineering program. He holds a number of industry certifications, including the CISSP, GSEC, GCIA, GCIH, and GPEN.