Agentic Detection Lookups
This gives AI agents structured access to LOLBAS, GTFOBins, and process parent-child relationship data without regex hell. It exposes six MCP tools: lookup a binary by name to get risk scores and MITRE mappings, check if a parent-child process pair is suspicious, search across all lookups, or filter by category or ATT&CK technique. The data ships as flat CSVs you can drop into CrowdStrike NG-SIEM, Splunk, Elastic, or Sentinel for enrichment queries. Reach for this when you're building detection engineering agents that need to triage binaries or validate process execution chains in real time. Weekly automated updates from upstream sources keep the 800+ entries current.
- tools
- 6
- last updated
- May 13, 2026
Tools
6 toolsPublic tool metadata for what this MCP can expose to an agent.
detection_lookup_binaryLooks up a filename and returns its risk, categories, MITRE IDs, and source (lolbas/gtfobins).
Looks up a filename and returns its risk, categories, MITRE IDs, and source (lolbas/gtfobins).
No parameter schema in public metadata yet.
detection_check_parent_childChecks whether a parent-to-child process relationship is expected or suspicious, with risk level and triage guidance.
Checks whether a parent-to-child process relationship is expected or suspicious, with risk level and triage guidance.
No parameter schema in public metadata yet.
detection_list_by_categoryReturns paginated binaries in a given abuse category, cross-platform.
Returns paginated binaries in a given abuse category, cross-platform.
No parameter schema in public metadata yet.
detection_list_by_mitreReturns paginated binaries mapped to a given MITRE ATT&CK technique, cross-platform.
Returns paginated binaries mapped to a given MITRE ATT&CK technique, cross-platform.
No parameter schema in public metadata yet.
detection_searchSearches across all lookup data and returns matches with total/has_more.
Searches across all lookup data and returns matches with total/has_more.
No parameter schema in public metadata yet.
detection_list_lookupsLists all lookup files with row counts and columns.
Lists all lookup files with row counts and columns.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
Agentic Detection Lookups
Machine-readable detection lookups for SIEM enrichment and AI agents. MCP-native.
Stop regex-matching 200+ binaries. Enrich in one
match()call.
Feed it to your SIEM, your SOAR, your agent, or your LLM.
What is this?
A collection of structured CSV lookup files purpose-built for:
- SIEM enrichment — one
match()/lookup/joinreplaces entire rule categories - AI agent tooling — MCP server included, agents query detection context in real-time
- Detection automation — consistent schema, CI-updated, deploy-ready
Lookup Files
| File | Entries | OS | Description |
|---|---|---|---|
lolbas_binaries.csv | 234 | Windows | Living Off The Land Binaries and Scripts — risk-scored, categorized, MITRE-mapped |
gtfobins.csv | 477 | Linux | GTFOBins Unix binaries — shell escape, priv-esc, file ops, MITRE-mapped |
parent_child_baselines.csv | 98 | Both | Expected/suspicious process parent→child relationships for Windows and Linux |
Schema Contract
Details
- Repository
- github.com/detection-forge/agentic-detection-lookups
- Category
- AI & LLM Tools
- Registry
- MCP registry, active
Related AI & LLM Tools MCP servers
View all
Mood Booster Agentedge-claw/mood-booster-agentERC-8004 AI Agent: uplifting messages, USDC tipping, and on-chain reputation feedback.0stars
Forge Agent Hubforge-agent-hub/forge-agent-mcpPay-per-call APIs via x402 USDC on Base. Hosted MCP: original gateway; stdio: full catalog.0stars
Blocksize Agentic Market Intelligencejf-cmyk/agentic-paymentsMulti-venue VWAP, bid/ask, crypto FX, metals and equities with provenance receipts for AI agents0stars
FinCore Agentic Commerceaiproductscout/fincoreAgentic commerce with 58 MCP tools for product search, checkout, A2A negotiation, C-Suite analytics.0stars
User Agent Parser APIbr0ski777/user-agent-parser-x402Parse user agents — browser, OS, device, bot detection. x402 micropayment.0stars
MCP Geminicrunchtools/mcp-geminiMCP server for Google Gemini AI - text, image, video, research, and more0stars