Kansa

Kansa is a modular incident response framework written in Powershell.

https://github.com/davehull/Kansa/

Once downloaded and extracted, use the following command to “unblock” the .PS1 files.

ls -r *.ps1 | Unblock-File

kansa_powershell_1

The main purpose of the framework is to use PowerShell Remoting to obtain information from several clients.  Several pre-built scripts such as for Netstat are available that can be executed as standalone.

kansa_powershell_2