How Push’s agentic threat hunting in the browser benefits every customer

Hey all you security engineers, let’s play Would You Rather … ?

Would you rather spend time trying to write detections for modern browser-based attacks by …

• Combing through MITRE looking for techniques that you can write detections on, only to find you have little useful telemetry from your typical sources.

• Curating a list of malicious domain IOCs extracted from endless TI pieces, only to never see a single one of them match.

• Just giving up and blocking a bunch of domains or IPs from every TI feed you come across, while quietly weeping.

Or … 

• Inherit constantly evolving detections validated across 3 million-plus browsers, tuned to remove false positives, informed by human threat researchers, and tailored to the known and not-yet-known threats that target account compromise and malware delivery via the browser.

At Push, we’ve built an agentic threat hunting and detection engineering pipeline to take that first set of onerous tasks off your plate. The result is a process that looks a lot like the ideal described in detection engineering maturity models, achieved without any extra headcount or subject matter expertise on your team, and scaled to meet the speed and complexity of our current era of AI-enabled adversaries.

Let’s take a look at how the pipeline delivers a collective good by identifying emerging threats or new technique variants in a single customer environment and then delivering detections to everyone.

Why detection engineering from TI is hard — and why AI-enabled attacks are making it even harder

Detection engineers feel the pain that Beethoven must have felt when he got the critique: “There are just too many notes!”

Except where notes = threat intelligence, light on the intelligence. (For a great unpacking of what’s hard about transforming TI into detections, check out this blog series from Anton Chuvakin and his Google security colleagues from 2023. The challenge has only gotten harder since then!)

In short, there is too much potential TI, too little actionable detail, and a dearth of useful business-relevant context.

This often manifests as:

• Feeling constantly behind the threat landscape. SANS Institute’s State of Detection Engineering 2026 report found that only 18% of practitioners feel like they’re staying ahead; 56% report barely keeping pace.

• Access to a huge amount of potential TI, but lacking the time, context, and tools needed to parse the data for threats that matter to the business.

• More information on IOCs than TTPs, leading to ever-growing blocklists and attacks that still slip through.

As AI-enabled adversaries continue to make it increasingly trivial to rotate infrastructure or abuse trusted services and workflows to deliver modern attacks, the hill gets steeper. 

In the case of attacks that target employees via the browser — using advanced phishing methods, commercial toolkits, abuse of OAuth, abuse of trusted services to deliver phishing lures, etc. — most security teams are also working without the right foundational visibility to even begin to mature their detection process against these TTPs.

The missing input is visibility at the layer where these attacks actually execute — the browser session. Without it, detection engineering for browser-based threats is painful guesswork.

How Push operationalized best practices for hunting from TI using agents

In building our agentic threat hunting and detection engineering pipeline at Push, we set out to solve many of the same problems that any security team faces when maturing its processes:

• How to transform TI into technique-level intel we could write durable detections for across a wide customer base at scale?

• How to create structured internal knowledge to add context to our detection engineering process that validates the relevance of what we find?

• How to verify what’s worthwhile to hunt for, remove false positives, and understand the value of a detection for a specific TTP across an install base of more than 3 million browsers?

The process we created looks a lot like the best practices on how to turn intelligence into meaningful detections. The difference is that agents let us run this process continuously and at a scale that would be impossible to achieve with human analysts alone.

It starts with ingestion. An agent tasked with TI aggregation monitors multiple industry sources — vendor reports, researcher disclosures, campaign teardowns — and filters for intelligence relevant to browser-based attack techniques. 

Because this agent already understands the types of attacks and scenarios that matter to Push’s detection surface, it can distinguish signal from noise at the intake stage, flagging useful intel and proposing initial lightweight hunts based on the browser metadata Push can observe. When a potential hunt looks promising, the aggregation agent hands off to a deeper analysis agent to extract what’s actually huntable.

That extraction step is where a general TI feed becomes something you can build detections from. Agents built on frontier models have a deep understanding of web programming languages and browser workflows can decompose the intelligence into its meaningful atomic units — the specific behavioral patterns that distinguish a malicious technique from normal browser activity. 

They compare those patterns against everything the Push browser agent can observe: tabs, windows, navigation events, downloads, network requests, DOM content, script execution. Then they discard anything too broad — observable events that are commonplace, even when connected to a malicious TTP — to avoid false positives. 

What survives is one or more huntable technique signatures that can be identified with a high true positive rate. This is the Pyramid of Pain principle operationalized at machine speed: Target the technique, not the indicator, because techniques are genuinely hard for attackers to change.

In parallel, the pipeline validates whether the identified technique is genuinely novel or a variant of something Push already detects. This is where our internal knowledge base comes into play. Built over three years by Push’s in-house research team and augmented continuously by the pipeline itself, it represents what Push knows about browser-based attack behaviors — a structured corpus of TTPs that lets agents classify incoming intelligence as new territory, a known variant that needs a refined detection, or something already covered. That classification determines what happens next: A net-new technique triggers a full hunt; a known variant triggers a refinement cycle; and a duplicate gets deprioritized.

The hunt itself is where hypothesis meets evidence. Agents develop a specific, testable prediction about what the technique looks like in browser telemetry, then validate that prediction across Push’s install base. The aim of the initial hunt is to identify any potential false positives — legitimate browser behavior that matches the pattern. Then the agents refine: adjusting the query, narrowing the behavioral fingerprints, testing again. Each iteration sharpens the detection until the false positive rate drops to a negligible, tolerable level. 

The hunts that produce relevant, high-confidence results become continuous queries — a kind of early warning system for emerging threats we’re actively watching for and learning about. The most useful and reliable of those queries become production detections that protect every Push customer in real time. 

This is what “detect what matters” looks like as an engineering discipline. By the time the agents have whittled down millions or trillions of browser events into a good hunt query — where good means broad enough to cast a usefully wide net for variations — and then tuned that further into a high-fidelity detection, the result is fewer, sharper detections by design. And because Push detects at the browser session layer before a user can interact with a malicious page, almost all of those detections fire pre-compromise. 

The same 2026 SANS survey mentioned earlier found that 66% of SOC practitioners cite vendor-provided rules as their primary source of false positives — a structural problem that persists at every organization size. Push’s pipeline produces the opposite outcome: better detections, less noise.

The result is a system with two learning loops. An inner loop handles real-time detection and response for known attacker techniques — the production detections already deployed across the customer base. An outer loop handles continuous discovery — agents hunting for new techniques, refining existing detections, and ingesting external intelligence. 

Each loop feeds the other: The outer loop’s discoveries become the inner loop’s new production detections, and the inner loop’s blocked attacks become raw material for the outer loop to analyze for novel variants. The knowledge base that both loops draw on grows with every cycle, which means the pipeline's detection coverage compounds at roughly the rate the threat landscape grows more complex.

And every validated detection produced by this process, whether it originated from a blocked attack in one customer’s environment, a proactive hunt across the telemetry corpus, or a vendor report about a campaign Push has never observed on customer estates, deploys to the entire customer base.

Herd immunity, without all the breaches to get there

That last point is where Push’s idea of herd immunity diverges from the traditional definition.

Detection and response platforms and MDR services commonly describe a herd immunity benefit: What one customer encounters, every customer gets protection against. The mechanism is real, but the learning input is typically a breach or a compromise. Someone has to be the first victim.

Push’s approach is different. 

Modern browser-based attacks frequently rely on a series of techniques strung together to achieve a compromise. From its vantage point in the browser, Push catches many novel techniques with existing detections pre-compromise because it recognizes a portion of the attack techniques in the chain. The detection process then identifies what’s new about a previously unseen variation of a known TTP — perhaps an evasion technique the kit hadn’t used before, an unusual lure or infrastructure pattern, etc. 

The detection gets better for customers and no one was compromised to get there.

On the external intelligence side, the pipeline ingests published research about a campaign Push has never observed, extracts the durable behavioral characteristics, validates them against browser telemetry, refines the query to tune out false positives, and ships detections before the technique is ever used against a Push customer. The protection arrives ahead of the attack.

These are the processes behind Push’s identification of ConsentFix, InstallFix, and LLMShare — three browser-based attack techniques Push's team discovered or documented for the first time. In several cases, detections were blocking active campaigns against Push customers before the technique had been publicly documented. Those detections rolled out to every customer within hours or days of first observation.

Outcomes: By the numbers

Looking at the quantifiable outcomes of this agentic threat hunting capability over the last few months, the benefits for customers become clear.

Velocity

Agents allow us to massively scale our research expertise, delivering detections for emerging threats or new variants much faster than humans alone can.

This year already, we’ve tripled the number of new detections shipped to customers.

We’ve also reduced the time it takes to ship production-ready detections for new threats from weeks to minutes.

Detection coverage

With that scaled expertise comes broad coverage. We perform an average of 300+ hunts a month (a mix of live queries for identified TTPs we’re looking for, plus net-new hunts for emerging threats we identify in any given month).

A few other metrics that demonstrate the scale of our detection coverage:

• 75+ attacker tools documented in our KB so far

• 25+ variants of existing attacks we’ve identified and shipped detections for

• 10,000+ monthly sessions analyzed

Protection from emerging threats

On the emerging threat side, our team was the first to identify or document three new browser-based attack techniques — ConsentFix, InstallFix, and LLMShare — shipping detections to all customers quickly after identification.

In that same time frame, we’ve also:

• Protected 60+ customers in the last 3 months who’ve been targeted with novel phishing techniques — identifying never-before-seen techniques, lures, delivery mechanisms, interactions, tools, or attack chains

• Prevented 225+ instances of threats pre-compromise for novel techniques

In all of the above situations, Push customers didn’t have to do anything — no combing through TI to find relevant details, no writing their own detections and tuning out false positives, or spending cycles to unpack a particularly knotty attack chain that used techniques they had never seen before. 

That’s what operationalized intelligence looks like at scale, delivered as a product, not a project.

Learn more about Push

The same foundational capabilities that enable this agentic threat hunting pipeline also deliver other security outcomes for Push customers: gaining visibility and control over AI tool usage; hardening identities by surfacing credential reuse, SSO gaps, and shadow IT; and supporting data loss and insider investigations with browser-layer telemetry that other tools can’t see.

If you’d like to learn more, book a demo with our team.