POWERSHELL / KQL
PowerShell IP Enrichment Utility
PowerShell · REST APIs · VirusTotal · CSV
A lightweight PowerShell utility that queries VirusTotal for a list of IP addresses, collects reputation and vendor verdicts, and exports structured results for analyst review.
Objective
Make IP reputation checks available in a structured format for analyst review.
Approach
Accept a list of IP addresses as function input.
Query the VirusTotal IP address API for each address.
Extract reputation, selected vendor verdicts, country, and WHOIS information.
Collect the records as PowerShell objects in an array.
Return the objects and export the results to CSV.
Technical decisions
Invoke-RestMethod handles the REST request. PSCustomObject gives each record consistent fields, with selected vendor verdicts kept as separate columns. Export-Csv writes the results without PowerShell type information.
Limitations
This is a small utility, not an end-to-end platform. The supplied script has no retry logic, rate-limit handling, or input validation; production deployment is not claimed. Reputation and vendor verdicts still require analyst interpretation.
Twill Typhoon: Scheduled Task Persistence Hunt
KQL · Microsoft Defender · Detection Engineering · Threat Hunting
KQL hunt developed from confidential threat intelligence concerning Twill Typhoon. It correlates executable extraction, subsequent file creation at a different path, optional renaming, and later scheduled task creation for analyst review.
The underlying threat intelligence report is confidential and is not reproduced or distributed here. This page shares Jordan Meisels’s hunt logic and a summary of the approach, including the filenames and folder indicators used in the query.
View repository ↗
Objective
Use endpoint telemetry to identify investigation candidates for possible scheduled task persistence, starting with a sequence of file behaviors.
Approach
Identify DLL or EXE file creation initiated by common archive extraction tools in DeviceFileEvents.
Correlate subsequent file creation at a different path on the same device, using matching SHA256 values and event ordering.
Treat later file renaming as supporting evidence, not a required condition for a device to remain a candidate.
Review ScheduledTaskCreated events in DeviceEvents that occur after the first candidate file behavior on each device.
Examine parsed task commands, arguments, and repetition intervals to guide further investigation.
Technical decisions
SHA256 and device identity link file creation events, while timestamps preserve event order. The earliest candidate file event per device anchors the scheduled-task review. The query retains RegExt.exe, CommonLib.dll, and MicrosoftEdgeServices as campaign-context indicators; it also reviews five-minute task repetition. Renaming is optional supporting evidence.
Limitations
Device-level correlation identifies investigation candidates, not proof that a scheduled task executed a particular file or that Twill Typhoon was responsible. Benign installers and updaters may produce similar behavior. The supplied query retains its original fixed time window; adjust it to your authorized dataset and verify the time column and TaskContent structure for your environment. This is hunt logic, not a claim of a deployed production alert or confirmed compromise.