Browser Extension

The Stairwell browser extension finds file hashes on whatever page you are reading and turns them into a link into Stairwell. It highlights MD5, SHA-1, and SHA-256 hashes as a page loads; you right-click one and open that file in the app. Install it from the Chrome Web Store, in Chrome, Edge, or another Chromium browser, and it works immediately with nothing to configure.

What problem does it solve?

Retyping hashes. That is the whole of it, and it is worth more than it sounds.

An analyst reading a vendor report, a blog post, a ticket, or a SIEM console meets a forty-character or sixty-four-character string and has to decide whether to go look it up. Copying it out by hand is a small enough cost that people skip the lookup, and a large enough cost that they make mistakes when they do not. Every hash on the page becoming a link removes the decision.

The lookups it saves are the ones nobody would have bothered with. That is where it earns its place: not the hash in the alert somebody was already investigating, but the fifth hash in an appendix that turns out to be the one you hold.

How do I install it in Chrome?

1. Open the Stairwell Extension listing in Chrome.
2. Click Add to Chrome and confirm.
3. The Stairwell icon appears in the toolbar. The extension is active.

How do I install it in Edge?

Edge installs Chrome Web Store extensions once you let it.

1. Open edge://extensions/.
2. Turn on Allow extensions from other stores, at the bottom left of the page.
3. Open the Stairwell Extension listing in Edge.
4. Click Add to Chrome. That is the Chrome Web Store's own button and it installs into Edge correctly.
5. The Stairwell icon appears in the toolbar.

On a managed Edge deployment that setting may be controlled by policy. If it is not yours to change, the extension can also be pushed centrally from the store listing by whoever administers the browser.

Does it work in other Chromium browsers?

Any Chromium-based browser that can install from the Chrome Web Store can install it, from the same listing. Browsers that cannot reach the store need their own sideloading procedure, which is a question for that browser's documentation rather than for Stairwell.

There is no Firefox or Safari build.

How do I use it?

1. Open a page that contains file hashes: a threat report, a ticket, a dashboard, a mailing list archive.
2. The extension scans the page as it loads and highlights the MD5, SHA-1, and SHA-256 hashes it finds.
3. Right-click a highlighted hash.
4. Choose the Stairwell entry in the context menu. The file opens in the Stairwell app.
5. Read the file's verdict, its prevalence, where it has been seen, and what resembles it. The Object Panel covers what you are looking at.

You need a signed-in Stairwell session in that browser for step 4 to land somewhere useful. Hash detection and highlighting happen without one, so the extension is not inert on a machine where nobody has logged in, but the lookup will ask you to sign in first.

What does it not do?

Worth knowing, because two of these get assumed.

• It does not send page content to Stairwell. Detection is pattern matching in the page you are already looking at, in your browser. Following a hash into the app is an ordinary navigation that you initiate.
• It does not upload files, and it does not change what Stairwell collects. It is a lookup convenience. What your fleet collects is set by the group policy in Asset Configuration, and nothing about installing this extension touches it.
• It does not find hashes that are not on the page as text. A hash inside a screenshot, a PDF rendered as an image, or a canvas element is invisible to it.
• A highlighted hash is not a claim that Stairwell holds the file. The highlight means the string looks like a hash. What Stairwell has for it, including nothing at all, is the answer you get after you follow the link.

What should I read next?

• The Object Panel, for reading what you land on.
• Is This File Anywhere Else?, for the next question after a hash resolves to something.
• New IOCs Were Published, for handling a whole report's worth of indicators rather than one hash at a time.