Analyst Script Runners

Execution layer for running Python, PowerShell, and batch scripts during penetration tests and malware behavior analysis. Everything is registered once in a config file and launched either as a single batch pass or from an interactive on-demand menu, with every run logged for later reporting.

Each runner follows the same class-based, single-file CLI structure (--mode / --output-json) used across my other security tooling (e.g. the geofencing anomaly-detection engine's --mode / --seed / --output-json CLI) — a *Runner class handles config loading, execution, and result tracking, and main() just wires CLI args to it.

Why this exists

Pen testing and malware analysis workflows mean juggling a growing pile of one-off scripts across languages: PowerShell for enumeration and event log review, Python for parsing/automation, batch for quick environment setup or cleanup. This gives them one consistent entry point per language, plus a combined menu for grabbing any of them on the fly mid-engagement.

• Batch mode — run every registered script of a type in one pass
• Menu mode — interactive, on-demand: pick a script, optionally pass extra args (e.g. a target IP or sample path), run it immediately
• JSON summaries — --output-json / -OutputJson writes a structured run summary (pass/fail, exit codes, timestamps) alongside the human-readable logs, for feeding into a report or another tool
• Fail-soft execution — one script erroring out doesn't stop the rest of a batch run
• Per-run logs — every execution gets its own timestamped log with full stdout/stderr

Files

File	Purpose
scripts_config.json	Registry of scripts, grouped by type
run_python.py	PythonScriptRunner — batch or menu mode for .py scripts
run_powershell.ps1	PowerShellScriptRunner class — batch or menu mode for .ps1 scripts
run_batch.bat	Batch or menu mode for .bat scripts
run_menu.ps1	Combined on-demand menu across all three types in one list

Setup

Edit scripts_config.json and register your scripts under the relevant type, with any default arguments:

{
  "python": [
    { "path": "C:\\Scripts\\python\\pe_static_analysis.py", "args": [] }
  ],
  "powershell": [
    { "path": "C:\\Scripts\\powershell\\process_tree_snapshot.ps1", "args": [] }
  ],
  "batch": [
    { "path": "C:\\Scripts\\batch\\reset_sandbox_snapshot.bat", "args": [] }
  ]
}
License
MIT License. Built for educational purposes, to ease and speed up my own pen testing process — not intended as production tooling.