Hunt harder, hunt smarter.
I build cybersecurity tools and automation for defenders. Open source modules for threat hunting, detection engineering, and security operations.
Production-ready tools for security operations
Finding ClickFix and FakeCAPTCHA like it's 1999. Detection and hunting tools for clipboard hijacking attacks.
Visit https://mhaggis.github.io/ClickGrab/ or git clone https://github.com/MHaggis/ClickGrab.git Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques. Built for red team testing and defense validation.
git clone https://github.com/MHaggis/NEBULA.git && Import-Module .\NEBULA.psm1 && Invoke-NEBULA Weekly YouTube show exploring atomic tests, detection engineering, and security research. Live demonstrations and deep dives into attack techniques.
Subscribe at youtube.com/@atomicsonafriday Living Off The Land Drivers - A curated list of Windows drivers used by adversaries to bypass security controls. The definitive resource for vulnerable driver detection.
curl -s https://www.loldrivers.io/api/drivers.json | jq PowerShell tools to help defenders hunt smarter, hunt harder. A collection of scripts, queries, and techniques for threat hunting using PowerShell.
git clone https://github.com/MHaggis/PowerShell-Hunter.git && cd PowerShell-Hunter && Import-Module .\PSHunter.psm1 Sources, configuration and how to detect evil things utilizing Microsoft Sysmon. A comprehensive collection of Sysmon configurations, documentation, and detection resources.
git clone https://github.com/MHaggis/sysmon-dfir.git && sysmon64.exe -accepteula -i sysmon-dfir\sysmonconfig.xml What I build and ship
Tools for threat hunting, detection engineering, and rapid incident triage.
Scripts and utilities to automate security tasks and harden environments.
Experimental tools and proof-of-concepts for emerging threats.
Security research videos and live demonstrations
Insights from the frontlines of defense
How adversaries weaponize MSIX packages for initial access, and how to detect it. Plus introducing MSIXBuilder for safe testing of detection coverage.
Real attack analysis from HoneyHarbor - catching a CVE-2025-3248 exploitation attempt in the wild and analyzing the attacker's techniques.
Major update to ClickGrab - migrated to Python with enhanced threat intelligence capabilities for detecting ClickFix and FakeCAPTCHA attacks.