Jon

Kansa Core: Consider using PSRunspaces over PSSessions

1

Boe Prox has some sample code and a few blog posts about PSRunspaces that make them seem like a much more performant option for multithreading collection activities. http://learn-powershell.net/2012/05/10/speedy-network-information-query-using-powershell/ http://learn-powershell.net/2014/06/11/norcal-powershell-user-group-presentation-on-runspaces-is-available/ https://github.com/proxb/PoshRSJob

Get-WebrootListing.ps1 output needs to be ASCII encoded

1

Received an error from Logparser when trying to analyze output from Get-WebrootListing.ps1 module that "some bytes remained undecoded" which blocked results. Re-encoding the output files to ASCII allowed Logparser to...

Cryptanalysis technique that defines the probability of drawing the same letter twice from a bag of all the letters in a message. Used by [NeoPI](https://github.com/Neohapsis/NeoPI) for web shell hunting. http://en.wikipedia.org/wiki/Index_of_coincidence

Kansa Analysis: Module Get-WebrootListing.ps1 needs analysis scripts

3

- Get-WebrootListingFileNameStack.ps1 - Get-WebrootListingFileSizeStack.ps1 - Get-WebrootListingEntropyStack.ps1 - Get-WebrootListingEntropyHistogram.ps1

Some tasks are common across multiple modules, and it would make sense to put these in a single library that can be included in the Modules that need them instead...

Kansa Core: Add ability to directly store output in Azure

1

Logging data to the hard drive of the analysis host is suitable for most cases, but when dealing with very large numbers of targets or when a web request is...

Similar to the OUTPUT and PUSHBIN directives, would allow a module to specify a minimum PowerShell version required to run. Kansa would need to check the remote PowerShell version, throw...