Hunt harder, hunt smarter.
I build cybersecurity tools and automation for defenders. Open source modules for threat hunting, detection engineering, and security operations.
Production-ready tools for security operations
Chrome Extension Security API - AI-powered threat detection for 10,000+ Chrome extensions. Analyze extensions for security risks, malicious behavior, and privacy concerns.
curl -H "Authorization: Bearer crx_your_api_key" "https://crx.michaelhaag.org/api/v1/extensions/{extension_id}" MCP server providing AI assistants with instant access to the complete MITRE ATT&CK framework - techniques, tactics, groups, software, and mitigations.
npx -y mitre-attack-mcp MCP server that lets AI assistants query 6,500+ security detection rules from Sigma, Splunk ESCU, and Elastic. Detection engineer harder and smarter with AI.
npx -y security-detections-mcp Finding ClickFix and FakeCAPTCHA like it's 1999. Detection and hunting tools for clipboard hijacking attacks.
Visit https://mhaggis.github.io/ClickGrab/ or git clone https://github.com/MHaggis/ClickGrab.git Interactive PowerShell framework for testing WMI, COM, LOLBAS, and persistence techniques. Built for red team testing and defense validation.
git clone https://github.com/MHaggis/NEBULA.git && Import-Module .\NEBULA.psm1 && Invoke-NEBULA Weekly YouTube show exploring atomic tests, detection engineering, and security research. Live demonstrations and deep dives into attack techniques.
Subscribe at youtube.com/@atomicsonafriday What I build and ship
Tools for threat hunting, detection engineering, and rapid incident triage.
Scripts and utilities to automate security tasks and harden environments.
Experimental tools and proof-of-concepts for emerging threats.
Security research videos and live demonstrations
Insights from the frontlines of defense
How adversaries weaponize MSIX packages for initial access, and how to detect it. Plus introducing MSIXBuilder for safe testing of detection coverage.
Real attack analysis from HoneyHarbor - catching a CVE-2025-3248 exploitation attempt in the wild and analyzing the attacker's techniques.
Major update to ClickGrab - migrated to Python with enhanced threat intelligence capabilities for detecting ClickFix and FakeCAPTCHA attacks.