Haag
mhaggis.bsky.social
Haag
@mhaggis.bsky.social
270 followers 210 following 34 posts
Just a person hacking away.
Posts Media Videos Starter Packs
🚨 Still on your journey to mastering ASR rules?
Don’t sleep on ASRGEN 🛡️💥

⚡ Point. Click. Generate ASR rules.
🔍 Learn + test safely with built-in atomic simulations
📦 Export to Intune/GPO-ready formats
🎯 Built for defenders, by defenders

👀🔥
👉 asrgen.streamlit.app

📚 github.com/MHaggis/ASRGEN
GitHub - MHaggis/ASRGEN: ASR Configurator, Essentials and Atomic Testing
ASR Configurator, Essentials and Atomic Testing. Contribute to MHaggis/ASRGEN development by creating an account on GitHub.
github.com
🆕🐇 Just dropped a 1-hour rabbit hole dive into API playgrounds, mocks, & random nerdy finds 🤓

We started with ClickGrab, but then it turned into:

🐝 Beeceptor

🛠️ Mockbin

🧩 Zudoku

🔍 VirusTotal hunts

🤖 ChatGPT making OpenAPI bins & routes

Chaotic, nerdy, fun. Come hang out 👉 youtu.be/j7QE-6p9Y9Q
🚀 Fresh ClickGrab ✨ | Into the Rabbit Hole 🐇🌀
🔥 We started fresh with ClickGrab 🖱️✨ looking at some new stuff… but then the whole thing flipped upside down 🌀 and turned into a full-on rabbit hole deep dive 🕳️🐇 🔍 What we explored: 🐝…
youtu.be
Minted narwhal!

I am/was burnt sienna goose
🚨 New ASR rules are now GA:

❌ Block rebooting in Safe Mode
🕵️‍♂️ Block copied/impersonated system tools

ASRGEN had these since preview. 😎

Want to:

⚡ Quickly create Intune-ready ASR policies
🧪 Simulate and understand rule impacts

Check → asrgen.streamlit.app

Be proactive. Be precise.
ASRGEN
Access ASRGEN here on https://asrgen.streamlit.app/
asrgen.streamlit.app
💰 The hunt begins…

The first drops for PowerShell-Hunter: Season 2 are coming SOON.
New tools. Smarter hunting. Sexier telemetry.
This isn’t just DFIR—it’s an evolution.

⚔️ Hunt smarter. Hunt harder.
github.com/MHaggis/Powe...
🚨 PowerShell-Hunter Season 2 is coming 🚨

💥 More atomic tools
🧬 Smarter, faster log analysis
🤖 Machine learning meets lateral movement
😈 PowerShell so slick it should be illegal

You’re not ready—but you should be.
⭐ Star the repo or miss the magic:
GitHub - MHaggis/PowerShell-Hunter: PowerShell tools to help defenders hunt smarter, hunt harder.
PowerShell tools to help defenders hunt smarter, hunt harder. - MHaggis/PowerShell-Hunter
github.com
Top 3 Things You'll Learn:
1️⃣ How attackers exploit SDDL—event log tampering, service hardening, & more
2️⃣ How to decode SDDL strings & analyze permissions, DACLs, and ACEs
3️⃣ How to defend against SDDL abuse with detections & Atomic Red Team tests

🧵 (3/)
In our latest blog, we break down SDDL: 🔹 How it structures Windows security
🔹 How attackers—from LockBit to RomCom—manipulate it for privilege escalation & defense evasion
🔹 How to detect & defend 🛡️

🧵 (2/)
🔐 Windows Security and SDDL: What You Need to Know 🔐

Windows permissions misconfigurations are a goldmine for attackers. SDDL (Security Descriptor Definition Language) remains overlooked yet highly exploitable. 🚨

@nasbench.bsky.social and I break it down -->

🧵 (1/)
Tomorrow, join us for a legendary episode of Atomics on a Friday featuring Jonathan Johnson (@jsecurity101) as we dive deep into JonMon—the tool redefining Windows telemetry!
🎄 Twas the night before JonMon, and all through the net,
🔍 Defenders were stirring, their systems to vet.
🛠️ The telemetry was hung in EventViewer with care,
✨ In hopes that Jonny Johnson soon would be there.

📅 Friday, January 24th
⏰ 11 AM MST | 1 PM EST
📺

YouTube: youtube.com/watch?v=CqEhtg…
https://youtube.com/watch?v=CqEhtg…
💻 How to Use:

1️⃣ Deploy your favorite tools (Sysmon, EDR, XDR, etc.)
2️⃣ Grab a webshell of choice, upload it, and start testing!
3️⃣Observe logs, alerts, and behaviors to identify gaps in your coverage.
notes/utilities/ApachePHPBuild at master · MHaggis/notes
Full of public notes and Utilities. Contribute to MHaggis/notes development by creating an account on GitHub.
buff.ly
🔍 Detection Opportunities:
Use these servers to validate analytic coverage for:

🗂️ File modifications (webshell uploads)
⚙️ Process executions (commands from shells)
🎯 Suspicious behaviors triggered by shells
notes/utilities/ApachePHPBuild at master · MHaggis/notes
Full of public notes and Utilities. Contribute to MHaggis/notes development by creating an account on GitHub.
buff.ly