Sign in

Haag

@mhaggis.bsky.social
275 followers 209 following 34 posts

Just a person hacking away.

PostsRepliesMedia
Haag @mhaggis.bsky.social · 11/09/2025
Hi
000
Haag @mhaggis.bsky.social · 21/08/2025
🚨 Still on your journey to mastering ASR rules? Don’t sleep on ASRGEN 🛡️💥 ⚡ Point. Click. Generate ASR rules. 🔍 Learn + test safely with built-in atomic simulations 📦 Export to Intune/GPO-ready formats 🎯 Built for defenders, by defenders 👀🔥 👉 asrgen.streamlit.app 📚 github.com/MHaggis/ASRGEN
github.com
GitHub - MHaggis/ASRGEN: ASR Configurator, Essentials and Atomic Testing
ASR Configurator, Essentials and Atomic Testing. Contribute to MHaggis/ASRGEN development by creating an account on GitHub.
000
Haag @mhaggis.bsky.social · 20/08/2025
🆕🐇 Just dropped a 1-hour rabbit hole dive into API playgrounds, mocks, & random nerdy finds 🤓 We started with ClickGrab, but then it turned into: 🐝 Beeceptor 🛠️ Mockbin 🧩 Zudoku 🔍 VirusTotal hunts 🤖 ChatGPT making OpenAPI bins & routes Chaotic, nerdy, fun. Come hang out 👉 youtu.be/j7QE-6p9Y9Q
youtu.be
🚀 Fresh ClickGrab ✨ | Into the Rabbit Hole 🐇🌀
🔥 We started fresh with ClickGrab 🖱️✨ looking at some new stuff… but then the whole thing flipped upside down 🌀 and turned into a full-on rabbit hole deep dive 🕳️🐇 🔍 What we explored: 🐝…
000
Haag @mhaggis.bsky.social · 14/04/2025
🚨 New ASR rules are now GA: ❌ Block rebooting in Safe Mode 🕵️‍♂️ Block copied/impersonated system tools ASRGEN had these since preview. 😎 Want to: ⚡ Quickly create Intune-ready ASR policies 🧪 Simulate and understand rule impacts Check → asrgen.streamlit.app Be proactive. Be precise.
asrgen.streamlit.app
ASRGEN
Access ASRGEN here on https://asrgen.streamlit.app/
021
Haag @mhaggis.bsky.social · 14/04/2025
💰 The hunt begins… The first drops for PowerShell-Hunter: Season 2 are coming SOON. New tools. Smarter hunting. Sexier telemetry. This isn’t just DFIR—it’s an evolution. ⚔️ Hunt smarter. Hunt harder. ⭐ github.com/MHaggis/Powe...
020
Haag @mhaggis.bsky.social · 10/04/2025
🚨 PowerShell-Hunter Season 2 is coming 🚨 💥 More atomic tools 🧬 Smarter, faster log analysis 🤖 Machine learning meets lateral movement 😈 PowerShell so slick it should be illegal You’re not ready—but you should be. ⭐ Star the repo or miss the magic:
github.com
GitHub - MHaggis/PowerShell-Hunter: PowerShell tools to help defenders hunt smarter, hunt harder.
PowerShell tools to help defenders hunt smarter, hunt harder. - MHaggis/PowerShell-Hunter
051
Haag @mhaggis.bsky.social · 04/03/2025
🎉 Exciting News: PCA Analyzer is now part of the PowerShell-Hunter suite! 🚀 Check it out on GitHub: github.com/MHaggis/PowerShell-Hunter 💻 📺
youtu.be
PCA Analyzer Demo: Uncover Hidden Windows Execution History | PowerShell-Hunter Toolkit
🔍 Discover the wealth of forensic evidence hiding in your Windows PCA logs!In this demonstration, I showcase the PCA Analyzer - a powerful forensic tool fro...
020
Haag @mhaggis.bsky.social · 21/02/2025
🔐 Windows Security and SDDL: What You Need to Know 🔐 Windows permissions misconfigurations are a goldmine for attackers. SDDL (Security Descriptor Definition Language) remains overlooked yet highly exploitable. 🚨 @nasbench.bsky.social and I break it down --> 🧵 (1/)
121
Haag @mhaggis.bsky.social · 24/01/2025
🎄 Twas the night before JonMon, and all through the net, 🔍 Defenders were stirring, their systems to vet. 🛠️ The telemetry was hung in EventViewer with care, ✨ In hopes that Jonny Johnson soon would be there. 📅 Friday, January 24th ⏰ 11 AM MST | 1 PM EST 📺 YouTube: youtube.com/watch?v=CqEhtg…
youtube.com
151
Haag @mhaggis.bsky.social · 07/12/2024
Down to the end of my last Christmas blend, what do you recommend this holiday season? I typically get Red Rooster or Atomic. www.redroostercoffee.com/products/goo... atomicroastery.com/products/mer...
redroostercoffee.com
Good Tidings - Holiday Sweet Coffee
With a delicious blast of candied fruit, Good Tidings warms up crisp mornings and brightens any breakfast! Sweet and syrupy with notes of orange ribbon candy, lilac, Amaretto, and Grand Marnier. Pair ...
010
Haag @mhaggis.bsky.social · 02/12/2024
Happy Monday
020
Haag @mhaggis.bsky.social · 27/11/2024
💡 Webshell Testing for Defenders 💡 Having automated tools to spin up web servers isn’t just convenient—it’s a game-changer for defenders. Here's why:
130
Haag @mhaggis.bsky.social · 27/11/2024
🚨 Unlocking the Secrets of Braodo Stealer! 🚨 Dive into our latest blog where the Splunk Threat Research Team dissects the elusive Python malware and its sneaky obfuscated loader! 🐍🔍✨ 🔓 Cracking the code of Braodo Stealer's obfuscation
splunk.com
Cracking Braodo Stealer: Analyzing Python Malware and Its Obfuscated Loader | Splunk
The Splunk Threat Research Team break down Braodo Stealer's loader mechanisms, obfuscation strategies, and payload behavior.
021
Haag @mhaggis.bsky.social · 25/11/2024
"Things that get built on a Monday... 🤔 "'Haag do you have a easy way to build a Apache|NGINX|IIS server to easy simulate webshells?' Hold my coffee... ☕ • 5-min Apache+PHP setup 🚀 • Drop-in webshell support 🎯 See you Tuesday! 😎
buff.ly
notes/utilities/ApachePHPBuild at master · MHaggis/notes
Full of public notes and Utilities. Contribute to MHaggis/notes development by creating an account on GitHub.
020
Haag @mhaggis.bsky.social · 22/11/2024
⚛️ Blast from the past Atomics on a Friday ⚛️ Attackers are weaponizing IIS modules for persistence, post-exploitation, and data theft. Check out the blog + AOAF for more 🔥: buff.ly/40UUWAI Don’t wait—watch to strengthen your defenses:
buff.ly
Atomics on a Friday Episode 4 IIS sassins
In this Atomics on a Friday, Paul and Michael will dive into IIS Components and showcase details on this stealthy technique and how adversaries abuse it.Refe...
010
Haag @mhaggis.bsky.social · 20/11/2024
🌟 Living off GitHub: The Stargazers Ghost Network!🌐 🔥 I somehow missed this, but WOW—what a fascinating deep dive into a DaaS operation! 🚀 Fully automated, primed for quick Ops, and makes you wonder about the ones we haven’t uncovered yet. 👀 buff.ly/3LCYEIP 🚨
buff.ly
Stargazers Ghost Network - Check Point Research
Check Point Research identified a network of GitHub accounts (Stargazers Ghost Network) that distribute malware or malicious links via phishing repositories. The network consists of multiple accounts…
010
Haag @mhaggis.bsky.social · 20/11/2024
🚀🔒 Validate Your AppLocker & WDAC Script Enforcement with ScriptHostTest.ps1! 🔒🚀 🔹 ✅ Validate AppLocker & WDAC: 🛡️ Test script execution in user & system paths seamlessly. 🔹 📝 Multiple File Types: Supports `.ps1`, `.bat` and more! 📂✨ Check it out here: buff.ly/3UVaJOm
010
Haag @mhaggis.bsky.social · 19/11/2024
🔥 Master PowerShell Security with Event ID 4104! 🔥 An oldie but a goodie! 🚀 Why you NEED to read this: 👉 Spot the bad guys! Uncover malicious scripts hiding in plain sight. 🔗 Blog: buff.ly/3YTbF75 💾 Utility: buff.ly/3UTO0m4 💥 Level up your logging game NOW! ⬆️
buff.ly
notes/utilities/Invoke-SPLPowerShellAuditLogging.ps1 at master · MHaggis/notes
Full of public notes and Utilities. Contribute to MHaggis/notes development by creating an account on GitHub.
020
Haag @mhaggis.bsky.social · 18/11/2024
A Thanksgiving Turkey from STRT to you.
000
Haag @mhaggis.bsky.social · 16/11/2024
💥 New Atomic Test ⚛️ Test your defenses against indirect command execution via RunMRU dialogs! 🖥️ Dive into Atomic Test #5 for T1202 and see if your analytics stack is ready to detect this sneaky tactic. 🚀 Get started:
buff.ly
001
Haag @mhaggis.bsky.social · 15/11/2024
🔍💻 PowerShell Pro Tip! 💻🔍 Ever wondered what app opens specific file extensions on your Windows machine? 🤔 Sure, it’s not new, but it’s super handy! 💪 Use this PowerShell magic to find file extensions and their associated apps
buff.ly
getfileassoc.ps1
GitHub Gist: instantly share code, notes, and snippets.
021
Reposted by Haag
Nasreddine Bencherchali @nasbench.bsky.social · 18/11/2023
LOLDrivers are cool 😎
051
Haag @mhaggis.bsky.social · 27/04/2023
“Hello world”
000