One place for the scripts and queries I've written across my IT career, from my homelab and from professional work. It covers security automation, Active Directory assessments, Intune hardening, and threat hunting in Microsoft Sentinel and Defender.
Everything is sorted by language. Anything under script_kiddie/ is me learning and practicing a language. Those files are exercises, not production tools.
Everything here is shared as-is. Read a script before you run it, and test in a lab before you point it at production.
| Script | What it does |
|---|---|
| combine_csv_files_to_excel.py | Merges every CSV in a folder into one Excel workbook, one sheet per CSV. Bolds and freezes the header row, adds filters, and sizes the columns. Needs openpyxl. |
Usage: python combine_csv_files_to_excel.py <csv_directory> <output_xlsx_path>
| Script | What it does |
|---|---|
| Invoke-ADGroupPermissionAssessment.ps1 | Finds stale accounts, members of privileged groups (Domain Admins, Enterprise Admins, and so on), disabled accounts still in groups, and empty groups. Gives each a risk level and exports everything to CSV. |
| Get-ADDomainControllerInventory.ps1 | Exports every domain controller, the FSMO role holders, functional levels, sites, subnets, and site links to CSV. |
| Invoke-DCRetirementAssessment.ps1 | Works offline from exported event logs (4768, 4769, 4770, 4771, 5156, 8004) and an AD computer export. Shows which clients still depend on a domain controller, so you know whether it's safe to retire. Supports a known-good suppression list with expiry dates. |
These need the ActiveDirectory module (RSAT) and read access to the domain.
| Script | What it does |
|---|---|
| Deploy-CISBaseline.ps1 | Deploys CIS benchmark policies and remediation scripts to Intune through Microsoft Graph. Creates new policies, updates changed ones, and skips identical ones, so it's safe to re-run. Supports -WhatIf. Policies are created unassigned on purpose. See the guide. |
The CIS benchmark templates are not in this repo. They come from CIS under their own license.
| Folder | What it does |
|---|---|
| ai_security/ | 20 tested hunting queries for finding shadow AI and AI misuse with Microsoft Sentinel and Defender advanced hunting: agent inventory, sensitive-purpose agents, Copilot jailbreak attempts, AI app consent grants, and Azure AI resource changes. The query index says what each one answers and where to run it. |
Reference material (not my work): top_300_sentinel_kql_use_cases.pdf, a community compilation of Sentinel KQL use cases that I learn from.
This is where I practice. Some files are unfinished on purpose and say so at the top.
| Folder | Source |
|---|---|
| claude_practice_questions/ | CSV, date, and validation labs |
| exercism_challenges/ | Exercism Python track |
| one_week_of_python/ | Beginner basics: strings, input, math |
| pynative/ | PYnative beginner and file-handling exercises |
| python_crash_course/ | Exercises from Python Crash Course |
| python_with_delvin/ | Classes, validation, and file practice sessions |
| Project | What it is |
|---|---|
| azure-appsec-pipeline | Connects CI/CD and the SIEM, so the pipeline's deploy and scan context reaches the same place as runtime detections. |
| codecrafters-git-python | A Git CLI built from scratch in Python. |
- Python:
snake_case.py(PEP 8), formatted with ruff - PowerShell:
Verb-Noun.ps1using approved verbs - KQL:
<table>_<what_it_does>_v<version>.md - Folders:
snake_case