Agentic Detection Lookups

LOLBAS, GTFOBins, and process parent-child lookups for detection engineering agents.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Remote HTTP

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "agentic-detection-lookups": {
      "url": "https://lolbas-project.github.io"
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

Agentic Detection Lookups

Machine-readable detection lookups for SIEM enrichment and AI agents. MCP-native.

Stop regex-matching 200+ binaries. Enrich in one match() call.
Feed it to your SIEM, your SOAR, your agent, or your LLM.

What is this?

A collection of structured CSV lookup files purpose-built for:

SIEM enrichment — one match()/lookup/join replaces entire rule categories
AI agent tooling — MCP server included, agents query detection context in real-time
Detection automation — consistent schema, CI-updated, deploy-ready

Lookup Files

File	Entries	OS	Description
`lolbas_binaries.csv`	232	Windows	Living Off The Land Binaries and Scripts — risk-scored, categorized, MITRE-mapped
`gtfobins.csv`	477	Linux	GTFOBins Unix binaries — shell escape, priv-esc, file ops, MITRE-mapped
`parent_child_baselines.csv`	97	Both	Expected/suspicious process parent→child relationships for Windows and Linux

Schema Contract

Every lookup file follows:

First column = match key (the field you join on)
Always includes risk or risk_if_unexpected column
Always includes MITRE ATT&CK technique mapping
No nested data — flat columns, pipe-delimited for multi-value
UTF-8, no BOM, Unix line endings, header row always present

Quick Start

SIEM (copy-paste)

CrowdStrike NG-SIEM:

cql

#event_simpleName=ProcessRollup2
| binary := lower(FileName)
| match(file="lolbas_binaries.csv", field=binary, column=filename, include=[categories, mitre_ids, risk])
| risk="high"

Splunk:

spl

index=crowdstrike event_simpleName=ProcessRollup2
| rex field=FileName "(?<binary>[^\\\\]+)$"
| lookup lolbas_binaries.csv filename AS binary OUTPUT categories mitre_ids risk
| where risk="high"

Elastic (ES|QL):

Dockerfile

FROM logs-endpoint.events.process-*
| WHERE event.action == "start"
| ENRICH lolbas-policy ON process.name = filename WITH categories, risk
| WHERE risk == "high"

Microsoft Sentinel:

kql

DeviceProcessEvents
| extend binary = tolower(FileName)
| join kind=inner (_GetWatchlist('lolbas_binaries')) on $left.binary == $right.filename
| where risk == "high"

See queries/ for full query libraries per platform.

MCP Server (AI agents)

config.json

{
  "servers": {
    "detection-lookups": {
      "type": "stdio",
      "command": "python",
      "args": ["-m", "mcp_server"],
      "cwd": "/path/to/agentic-detection-lookups"
    }
  }
}

Then your agent can:

Code

→ detection_lookup_binary("certutil.exe")
← {source: "lolbas", risk: "medium", categories: ["Download"], mitre_ids: ["T1105"]}

→ detection_lookup_binary("python")
← {source: "gtfobins", risk: "high", categories: ["shell", "reverse-shell", ...], mitre_ids: ["T1059"]}

→ detection_check_parent_child("winword.exe", "cmd.exe")
← {expected: false, risk_if_unexpected: "critical", mitre_id: "T1204.002"}

MCP Tools

Tool	Input	Output
`detection_lookup_binary`	filename	Risk, categories, MITRE IDs, source (lolbas/gtfobins)
`detection_check_parent_child`	parent, child, os_filter	Expected/suspicious, risk level, triage guidance
`detection_list_by_category`	category, limit, offset	Paginated binaries in that abuse category (cross-platform)
`detection_list_by_mitre`	technique_id, limit, offset	Paginated binaries mapped to that technique (cross-platform)
`detection_search`	query, limit	Matches across all lookup data with total/has_more
`detection_list_lookups`	—	All files with row counts and columns

Data Sources

Lookup	Source	Update Frequency
LOLBAS binaries	LOLBAS Project	Weekly (automated)

Installation

Prerequisites

Python 3.10+
VS Code with GitHub Copilot (for MCP integration)

Install

bash

git clone https://github.com/detection-forge/agentic-detection-lookups.git
cd agentic-detection-lookups
python -m venv .venv
# Windows:
.venv\Scripts\activate
# Linux/macOS:
source .venv/bin/activate
pip install -e .

Configure MCP Client (VS Code)

Add to your VS Code User settings (Ctrl+Shift+P → "Preferences: Open User Settings (JSON)") or ~/.vscode/mcp.json:

config.json

{
  "servers": {
    "detection-lookups": {
      "type": "stdio",
      "command": "/absolute/path/to/.venv/bin/python",
      "args": ["-m", "mcp_server"],
      "cwd": "/absolute/path/to/agentic-detection-lookups"
    }
  }
}

Windows example:

config.json

{
  "servers": {
    "detection-lookups": {
      "type": "stdio",
      "command": "C:\\Code\\.venv\\Scripts\\python.exe",
      "args": ["-m", "mcp_server"],
      "cwd": "C:\\Code\\agentic-detection-lookups"
    }
  }
}

Reload VS Code: Ctrl+Shift+P → "Reload Window"

Verify

In Copilot Chat (Agent mode):

Code

Is certutil.exe a LOLBAS binary?

✅ Returns risk, categories, and MITRE mappings = working!

Run standalone (CLI)

bash

detection-lookups

This starts the MCP server on stdio transport (useful for piping JSON-RPC or connecting other MCP clients).

Upload to your SIEM

CrowdStrike NG-SIEM: Upload via API or UI (Settings → Lookup Files)
Splunk: Settings → Lookups → Lookup table files → Add new
Elastic: Create enrich index + ingest pipeline
Sentinel: Configuration → Watchlist → Add new

Project Structure

Code

agentic-detection-lookups/
├── lookups/                    # The data (CSV files)
│   ├── lolbas_binaries.csv
│   ├── gtfobins.csv
│   └── parent_child_baselines.csv
├── queries/                    # Copy-paste detection queries
│   ├── crowdstrike_ngsiem.md
│   ├── splunk.md
│   ├── elastic.md
│   └── microsoft_sentinel.md
├── mcp_server/                 # MCP server for AI agents
│   ├── server.py
│   └── __init__.py
├── scripts/                    # Update/maintenance scripts
├── LICENSE                     # Apache 2.0
├── NOTICE
└── pyproject.toml

Contributing

PRs welcome. See CONTRIBUTING.md for guidelines.

To add a new lookup file:

Follow the schema contract (match key first, include risk + MITRE columns)
Include at least one query example per SIEM platform
Add a tool to the MCP server

License

Apache 2.0 — See LICENSE and NOTICE.

Built by Gene Kazimiarovich | Part of Detection Forge

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Agentic Detection Lookups

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "agentic-detection-lookups": { "command": "npx", "args": ["-y", "Agentic Detection Lookups"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Agentic Detection Lookups AllMCPs Directory Badge

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/agentic-detection-lookups?style=directory)](https://allmcps.com/mcp/agentic-detection-lookups)

HTML Embed

<a href="https://allmcps.com/mcp/agentic-detection-lookups"><img src="https://allmcps.com/api/badge/agentic-detection-lookups?style=directory" alt="Agentic Detection Lookups on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

36Quality signal: Fair · 36/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools16/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge and attach your website — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Agentic Detection Lookups →Install in Claude Desktop Install in Cursor Install in VS Code

Agentic Detection Lookups

LOLBAS, GTFOBins, and process parent-child lookups for detection engineering agents.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Remote HTTP

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "agentic-detection-lookups": {
      "url": "https://lolbas-project.github.io"
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

Agentic Detection Lookups

Machine-readable detection lookups for SIEM enrichment and AI agents. MCP-native.

Stop regex-matching 200+ binaries. Enrich in one match() call.
Feed it to your SIEM, your SOAR, your agent, or your LLM.

What is this?

A collection of structured CSV lookup files purpose-built for:

SIEM enrichment — one match()/lookup/join replaces entire rule categories
AI agent tooling — MCP server included, agents query detection context in real-time
Detection automation — consistent schema, CI-updated, deploy-ready

Lookup Files

File	Entries	OS	Description
`lolbas_binaries.csv`	232	Windows	Living Off The Land Binaries and Scripts — risk-scored, categorized, MITRE-mapped
`gtfobins.csv`	477	Linux	GTFOBins Unix binaries — shell escape, priv-esc, file ops, MITRE-mapped
`parent_child_baselines.csv`	97	Both	Expected/suspicious process parent→child relationships for Windows and Linux

Schema Contract

Every lookup file follows:

First column = match key (the field you join on)
Always includes risk or risk_if_unexpected column
Always includes MITRE ATT&CK technique mapping
No nested data — flat columns, pipe-delimited for multi-value
UTF-8, no BOM, Unix line endings, header row always present

Quick Start

SIEM (copy-paste)

CrowdStrike NG-SIEM:

cql

#event_simpleName=ProcessRollup2
| binary := lower(FileName)
| match(file="lolbas_binaries.csv", field=binary, column=filename, include=[categories, mitre_ids, risk])
| risk="high"

Splunk:

spl

index=crowdstrike event_simpleName=ProcessRollup2
| rex field=FileName "(?<binary>[^\\\\]+)$"
| lookup lolbas_binaries.csv filename AS binary OUTPUT categories mitre_ids risk
| where risk="high"

Elastic (ES|QL):

Dockerfile

FROM logs-endpoint.events.process-*
| WHERE event.action == "start"
| ENRICH lolbas-policy ON process.name = filename WITH categories, risk
| WHERE risk == "high"

Microsoft Sentinel:

kql

DeviceProcessEvents
| extend binary = tolower(FileName)
| join kind=inner (_GetWatchlist('lolbas_binaries')) on $left.binary == $right.filename
| where risk == "high"

See queries/ for full query libraries per platform.

MCP Server (AI agents)

config.json

{
  "servers": {
    "detection-lookups": {
      "type": "stdio",
      "command": "python",
      "args": ["-m", "mcp_server"],
      "cwd": "/path/to/agentic-detection-lookups"
    }
  }
}

Then your agent can:

Code

→ detection_lookup_binary("certutil.exe")
← {source: "lolbas", risk: "medium", categories: ["Download"], mitre_ids: ["T1105"]}

→ detection_lookup_binary("python")
← {source: "gtfobins", risk: "high", categories: ["shell", "reverse-shell", ...], mitre_ids: ["T1059"]}

→ detection_check_parent_child("winword.exe", "cmd.exe")
← {expected: false, risk_if_unexpected: "critical", mitre_id: "T1204.002"}

MCP Tools

Tool	Input	Output
`detection_lookup_binary`	filename	Risk, categories, MITRE IDs, source (lolbas/gtfobins)
`detection_check_parent_child`	parent, child, os_filter	Expected/suspicious, risk level, triage guidance
`detection_list_by_category`	category, limit, offset	Paginated binaries in that abuse category (cross-platform)
`detection_list_by_mitre`	technique_id, limit, offset	Paginated binaries mapped to that technique (cross-platform)
`detection_search`	query, limit	Matches across all lookup data with total/has_more
`detection_list_lookups`	—	All files with row counts and columns

Data Sources

Lookup	Source	Update Frequency
LOLBAS binaries	LOLBAS Project	Weekly (automated)

Installation

Prerequisites

Python 3.10+
VS Code with GitHub Copilot (for MCP integration)

Install

bash

git clone https://github.com/detection-forge/agentic-detection-lookups.git
cd agentic-detection-lookups
python -m venv .venv
# Windows:
.venv\Scripts\activate
# Linux/macOS:
source .venv/bin/activate
pip install -e .

Configure MCP Client (VS Code)

Add to your VS Code User settings (Ctrl+Shift+P → "Preferences: Open User Settings (JSON)") or ~/.vscode/mcp.json:

config.json

{
  "servers": {
    "detection-lookups": {
      "type": "stdio",
      "command": "/absolute/path/to/.venv/bin/python",
      "args": ["-m", "mcp_server"],
      "cwd": "/absolute/path/to/agentic-detection-lookups"
    }
  }
}

Windows example:

config.json

{
  "servers": {
    "detection-lookups": {
      "type": "stdio",
      "command": "C:\\Code\\.venv\\Scripts\\python.exe",
      "args": ["-m", "mcp_server"],
      "cwd": "C:\\Code\\agentic-detection-lookups"
    }
  }
}

Reload VS Code: Ctrl+Shift+P → "Reload Window"

Verify

In Copilot Chat (Agent mode):

Code

Is certutil.exe a LOLBAS binary?

✅ Returns risk, categories, and MITRE mappings = working!

Run standalone (CLI)

bash

detection-lookups

This starts the MCP server on stdio transport (useful for piping JSON-RPC or connecting other MCP clients).

Upload to your SIEM

CrowdStrike NG-SIEM: Upload via API or UI (Settings → Lookup Files)
Splunk: Settings → Lookups → Lookup table files → Add new
Elastic: Create enrich index + ingest pipeline
Sentinel: Configuration → Watchlist → Add new

Project Structure

Code

agentic-detection-lookups/
├── lookups/                    # The data (CSV files)
│   ├── lolbas_binaries.csv
│   ├── gtfobins.csv
│   └── parent_child_baselines.csv
├── queries/                    # Copy-paste detection queries
│   ├── crowdstrike_ngsiem.md
│   ├── splunk.md
│   ├── elastic.md
│   └── microsoft_sentinel.md
├── mcp_server/                 # MCP server for AI agents
│   ├── server.py
│   └── __init__.py
├── scripts/                    # Update/maintenance scripts
├── LICENSE                     # Apache 2.0
├── NOTICE
└── pyproject.toml

Contributing

PRs welcome. See CONTRIBUTING.md for guidelines.

To add a new lookup file:

Follow the schema contract (match key first, include risk + MITRE columns)
Include at least one query example per SIEM platform
Add a tool to the MCP server

License

Apache 2.0 — See LICENSE and NOTICE.

Built by Gene Kazimiarovich | Part of Detection Forge

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Agentic Detection Lookups

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "agentic-detection-lookups": { "command": "npx", "args": ["-y", "Agentic Detection Lookups"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/agentic-detection-lookups?style=directory)](https://allmcps.com/mcp/agentic-detection-lookups)

HTML Embed

<a href="https://allmcps.com/mcp/agentic-detection-lookups"><img src="https://allmcps.com/api/badge/agentic-detection-lookups?style=directory" alt="Agentic Detection Lookups on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

36Quality signal: Fair · 36/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools16/30

Adoption & activity1/15

Community engagement0/10

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Agentic Detection Lookups →Install in Claude Desktop Install in Cursor Install in VS Code