Kansa collect

.\kansa.ps1 -Verbose

Collect forensic data from all Windows hosts in the domain with Kansa (distributed remote PowerShell) in a single command.

Run it when you need distributed collection without installing agents: Kansa uses PowerShell remoting (WinRM) to launch collection modules (processes, services, connections, Run keys, filtered EVTX, autoruns) on all domain hosts, and consolidates results into CSV with the timeline. It's the lightweight alternative to Velociraptor when you don't want (or can't) deploy agents: you only need WinRM enabled and credentials with permissions. In an IR with hundreds of Windows hosts, Kansa answers 'which hosts have this Run key?' or 'where does this process run?' in one pass.

Don't use it if WinRM is not enabled or is restricted by GPO (very common in mature environments): collection will fail host by host and you'll have a partial collection without clear warning. Collection via PowerShell remoting is noisy: each host generates events 4624/4648 for management connections — in an environment with an active SOC, mass collection overnight can trigger lateral movement alerts. And watch out for volume: modules that collect full EVTX generate traffic and load; choose modules by question, don't collect everything 'just in case'.