Defensive Toolkit

Companion repository to SecurityScriptographer (https://www.securityscriptographer.com). Every script and detection rule here has a full write-up on the blog explaining what it does, why it is built the way it is, and what its limitations are. The blog post is the documentation; this repo is the download.

Python

Standalone Python tools for threat hunting: file hashing and IOC matching, IOC extraction from logs, VirusTotal lookups, file integrity monitoring, and EVTX parsing.

File	Description	Blog post
python/file_hashing_ioc_match.py	Hash files (MD5/SHA-1/SHA-256) and match them against an IOC hash list.	Write-up
python/extract_iocs_regex.py	Extract and refang IPs, URLs, domains, and hashes from raw log text with regex.	Write-up
python/virustotal_hash_lookup.py	Look up file hashes against the VirusTotal v3 API with free-tier rate limiting.	Write-up
python/file_integrity_monitor.py	Baseline a directory tree and report added, changed, and removed files.	Write-up
python/parse_evtx.py	Parse Windows EVTX event logs into workable Python objects with python-evtx.	Write-up
python/port_scanner.py	Small TCP port scanner for checking your own hosts' exposure.	Write-up

PowerShell

PowerShell scripts for endpoint triage, security auditing, and Windows event log management.

File	Description	Blog post
powershell/Invoke-SecurityAudit.ps1	Local security audit: system, security settings, accounts, and services, exported to CSV/JSON.	Write-up
powershell/endpoint-triage-checks.ps1	The eleven endpoint triage checks from the threat hunting guide: processes, services, autoruns, signatures, connections.	Write-up
powershell/eventlog-management.ps1	Event log queries and log size/retention management snippets for Windows security logs.	Write-up
powershell/Export-ProjectOnlineMpp.ps1	Bulk-export Project Online projects to .mpp via the Project Professional COM interface, before the 2026-09-30 retirement.	Write-up

Sigma rules

Sigma detection rules, one per technique and Windows Event ID, as developed in the blog's Sigma series. Convert them for your backend with sigma-cli.

File	Description	Blog post
detections/sigma/win_security_1102_log_cleared.yml	Security event log cleared (Event ID 1102).	Write-up
detections/sigma/win_system_104_log_cleared.yml	Non-Security event log channel cleared (System Event ID 104).	Write-up
detections/sigma/proc_creation_eventlog_clear_cmdline.yml	Event log cleared via command-line tooling (wevtutil, Clear-EventLog).	Write-up
detections/sigma/sysmon_10_lsass_credential_access.yml	LSASS credential access via Sysmon Event ID 10 process access.	Write-up
detections/sigma/win_security_4698_susp_scheduled_task.yml	Suspicious scheduled task registered (Event ID 4698).	Write-up
detections/sigma/proc_creation_schtasks_staging.yml	Scheduled task created via schtasks.exe with staging indicators.	Write-up
detections/sigma/sysmon_13_runkey_persistence.yml	Suspicious Run-key persistence via Sysmon Event ID 13 registry writes.	Write-up
detections/sigma/sysmon_13_high_risk_autostart_keys.yml	Modification of high-risk logon autostart keys (Winlogon, IFEO, AppInit).	Write-up
detections/sigma/win_system_7045_susp_service_install.yml	Suspicious service installed (Event ID 7045).	Write-up
detections/sigma/win_system_7045_kernel_driver_service.yml	Kernel-mode driver service installed (Event ID 7045).	Write-up
detections/sigma/proc_creation_sc_exe_staging.yml	Service created via sc.exe with staging indicators.	Write-up
detections/sigma/win_security_4769_kerberoasting_rc4.yml	Potential Kerberoasting via RC4 service ticket requests (Event ID 4769).	Write-up

YARA rules

YARA rules from the blog's YARA introduction.

File	Description	Blog post
detections/yara/ss_suspicious_powershell_artifact.yar	PowerShell host invocation paired with staging primitives (encoded commands, download cradles).	Write-up
detections/yara/ss_packed_pe_indicators.yar	Heuristic for packed PEs: few sections, low entry point, UPX markers or high section entropy.	Write-up

KQL queries

Advanced Hunting (Microsoft Defender XDR) and Sentinel KQL query collections. Each file bundles the queries from one blog post, with the original section headings as comments.

File	Description	Blog post
detections/kql/entra-password-spray.kql	Entra ID sign-in log queries for password spray detection and spray-source pivoting.	Write-up
detections/kql/defender-threat-hunting.kql	The Advanced Hunting queries from the KQL threat hunting complete guide.	Write-up
detections/kql/defender-useful-queries.kql	Standalone Advanced Hunting queries: logon anomalies, email threats, correlated sign-in activity.	Write-up
detections/kql/defender-persistence-lolbin.kql	Hunting persistence mechanisms and LOLBin abuse in Defender Advanced Hunting.	publishing soon

Related repositories

• mitre - Python toolchain for fetching MITRE ATT&CK STIX data, mapping it to D3FEND, and building Navigator coverage layers.

Authorized use

Everything in this repository is published for defensive use: detection engineering, hardening, triage, and authorized testing on systems you own or have written permission to assess.

License

MIT. Attribution is appreciated - a link to the blog does more than a star.