Provides detection lookup files for enrichment in Elasticsearch, enabling efficient threat detection queries using ES|QL ENRICH.
Provides MCP tools for AI agents (e.g., GitHub Copilot) to query detection lookups for binary risk, parent-child relationships, and MITRE mappings in real-time.
Provides detection lookup files for enrichment in Splunk, enabling efficient lookup operations for threat detection.
Machine-readable detection lookups for SIEM enrichment and AI agents. MCP-native.
Stop regex-matching 200+ binaries. Enrich in one
match()call.
Feed it to your SIEM, your SOAR, your agent, or your LLM.
A collection of structured CSV lookup files purpose-built for:
SIEM enrichment — one match()/lookup/join replaces entire rule categories
AI agent tooling — MCP server included, agents query detection context in real-time
Detection automation — consistent schema, CI-updated, deploy-ready
Related MCP server: contrastapi
File | Entries | OS | Description |
232 | Windows | Living Off The Land Binaries and Scripts — risk-scored, categorized, MITRE-mapped | |
477 | Linux | GTFOBins Unix binaries — shell escape, priv-esc, file ops, MITRE-mapped | |
97 | Both | Expected/suspicious process parent→child relationships for Windows and Linux |
Every lookup file follows:
First column = match key (the field you join on)
Always includes risk or risk_if_unexpected column
Always includes MITRE ATT&CK technique mapping
No nested data — flat columns, pipe-delimited for multi-value
UTF-8, no BOM, Unix line endings, header row always present
CrowdStrike NG-SIEM:
#event_simpleName=ProcessRollup2
| binary := lower(FileName)
| match(file="lolbas_binaries.csv", field=binary, column=filename, include=[categories, mitre_ids, risk])
| risk="high"Splunk:
index=crowdstrike event_simpleName=ProcessRollup2
| rex field=FileName "(?<binary>[^\\\\]+)$"
| lookup lolbas_binaries.csv filename AS binary OUTPUT categories mitre_ids risk
| where risk="high"Elastic (ES|QL):
FROM logs-endpoint.events.process-*
| WHERE event.action == "start"
| ENRICH lolbas-policy ON process.name = filename WITH categories, risk
| WHERE risk == "high"Microsoft Sentinel:
DeviceProcessEvents
| extend binary = tolower(FileName)
| join kind=inner (_GetWatchlist('lolbas_binaries')) on $left.binary == $right.filename
| where risk == "high"See queries/ for full query libraries per platform.
{
"servers": {
"detection-lookups": {
"type": "stdio",
"command": "python",
"args": ["-m", "mcp_server"],
"cwd": "/path/to/agentic-detection-lookups"
}
}
}Then your agent can:
→ detection_lookup_binary("certutil.exe")
← {source: "lolbas", risk: "medium", categories: ["Download"], mitre_ids: ["T1105"]}
→ detection_lookup_binary("python")
← {source: "gtfobins", risk: "high", categories: ["shell", "reverse-shell", ...], mitre_ids: ["T1059"]}
→ detection_check_parent_child("winword.exe", "cmd.exe")
← {expected: false, risk_if_unexpected: "critical", mitre_id: "T1204.002"}Tool | Input | Output |
| filename | Risk, categories, MITRE IDs, source (lolbas/gtfobins) |
| parent, child, os_filter | Expected/suspicious, risk level, triage guidance |
| category, limit, offset | Paginated binaries in that abuse category (cross-platform) |
| technique_id, limit, offset | Paginated binaries mapped to that technique (cross-platform) |
| query, limit | Matches across all lookup data with total/has_more |
| — | All files with row counts and columns |
Lookup | Source | Update Frequency |
LOLBAS binaries | Weekly (automated) |
Python 3.10+
VS Code with GitHub Copilot (for MCP integration)
git clone https://github.com/detection-forge/agentic-detection-lookups.git
cd agentic-detection-lookups
python -m venv .venv
# Windows:
.venv\Scripts\activate
# Linux/macOS:
source .venv/bin/activate
pip install -e .Add to your VS Code User settings (Ctrl+Shift+P → "Preferences: Open User Settings (JSON)") or ~/.vscode/mcp.json:
{
"servers": {
"detection-lookups": {
"type": "stdio",
"command": "/absolute/path/to/.venv/bin/python",
"args": ["-m", "mcp_server"],
"cwd": "/absolute/path/to/agentic-detection-lookups"
}
}
}Windows example:
{ "servers": { "detection-lookups": { "type": "stdio", "command": "C:\\Code\\.venv\\Scripts\\python.exe", "args": ["-m", "mcp_server"], "cwd": "C:\\Code\\agentic-detection-lookups" } } }
Reload VS Code: Ctrl+Shift+P → "Reload Window"
In Copilot Chat (Agent mode):
Is certutil.exe a LOLBAS binary?✅ Returns risk, categories, and MITRE mappings = working!
detection-lookupsThis starts the MCP server on stdio transport (useful for piping JSON-RPC or connecting other MCP clients).
CrowdStrike NG-SIEM: Upload via API or UI (Settings → Lookup Files)
Splunk: Settings → Lookups → Lookup table files → Add new
Elastic: Create enrich index + ingest pipeline
Sentinel: Configuration → Watchlist → Add new
agentic-detection-lookups/
├── lookups/ # The data (CSV files)
│ ├── lolbas_binaries.csv
│ ├── gtfobins.csv
│ └── parent_child_baselines.csv
├── queries/ # Copy-paste detection queries
│ ├── crowdstrike_ngsiem.md
│ ├── splunk.md
│ ├── elastic.md
│ └── microsoft_sentinel.md
├── mcp_server/ # MCP server for AI agents
│ ├── server.py
│ └── __init__.py
├── scripts/ # Update/maintenance scripts
├── LICENSE # Apache 2.0
├── NOTICE
└── pyproject.tomlPRs welcome. See CONTRIBUTING.md for guidelines.
To add a new lookup file:
Follow the schema contract (match key first, include risk + MITRE columns)
Include at least one query example per SIEM platform
Add a tool to the MCP server
Apache 2.0 — See LICENSE and NOTICE.
Built by Gene Kazimiarovich | Part of Detection Forge
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
Real-time threat intel for AI agents: 890K+ IOCs incl. prompt-injection & AI-skill threats
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/detection-forge/agentic-detection-lookups'
If you have feedback or need assistance with the MCP directory API, please join our Discord server