aseps

Kansa: Powershell profiles potentially hazardous

| | aseps, Kansa, powershell, powershell profiles
On the very day I published my previous post, Kansa: Collecting WMI Event Consumer backdoors, Mark Russinovich announced the release of a new version of Autoruns that collects WMI related ASEPs. I ...
trustedsignal -- blog
Kansa: Collecting WMI Event Consumer backdoors

Kansa: Collecting WMI Event Consumer backdoors

| | aseps, backdoor, Kansa, WMI Event Consumer
In my previous post, Kansa: Service related collectors and analysis, I discussed the Windows Service related collectors and analysis capabilities in Kansa and noted that some of the collected data is not ...
trustedsignal -- blog
Kansa: Service related collectors and analysis

Kansa: Service related collectors and analysis

| | aseps, autoruns, DFIR, Failures, frequency analysis, Kansa, services, stack ranking, stacking, triggers
In my previous post on Kansa's Autoruns collectors and analysis scripts, I mentioned that the Get-Aurounsc.ps1 collector relies on Sysinternals' Autorunsc.exe to collect data on all of the Autostart Extension Points (ASEPs) that ...
trustedsignal -- blog
Kansa: Autoruns data and analysis

Kansa: Autoruns data and analysis

| | aseps, autoruns, DFIR, Kansa
I want your input.With the "Trailer Park" release of Kansa marking a milestone for the core framework, I'm turning my focus to analysis scripts for data collected by the current set of modules. As of ...
trustedsignal -- blog