Example Queries

Queries worth stealing. Each one is valid CEL, so paste it into the search bar, swap the values for yours, and go. Placeholders in angle brackets are yours to fill in. Remember that a query only returns results on the tab matching the entity it names.

How do I find a specific file?

object.sha256 == "<SHA256>"

object.hash == "<HASH>"

object.hash matches SHA256, SHA1, or MD5, which is what you want when somebody hands you a hash without saying which kind it is.

object.sha256 in ["<HASH1>","<HASH2>","<HASH3>"]

A list is how you sweep every hash from a report in one query.

How do I find files that share a build fingerprint?

object.imphash == "<IMPHASH>"

An import hash groups binaries that import the same functions in the same order, which frequently survives a recompile. It is a cheap way to find the siblings of a sample, and it is complementary to Variants rather than a replacement for it.

object.pe_sections_sha256 == "<SECTION_HASH>"

Matches files that share an individual PE section, which finds the reuse of one component across otherwise different files.

How do I find files by verdict?

mal_eval.malicious == true

mal_eval.label.contains("trojan")

mal_eval.malicious == true && asset.count > 0

The last one is the practically useful form: malicious files that are actually present on your assets. See Verdicts and Prevalence.

How do I find files by signing status?

object.authenticode_verification_result == "VALID"

object.authenticode_verification_result == "INVALID"

object.authenticode_verification_result == "UNSUPPORTED"

INVALID is the interesting one. A signature that does not verify is a stronger signal than no signature at all, because somebody went to the trouble of putting one there.

How do I find files by time?

object.global_first_seen_time.after(timestamp("2026-01-01T00:00:00Z"))

object.first_seen_time.after(timestamp("2026-01-01T00:00:00Z"))

The first is when Stairwell first saw the file anywhere. The second is when it first appeared in the environment, which is the one that answers "when did this reach us". StairQL expresses the same window far more briefly as fs:7d+ or envfs:7d+.

How do I find files by YARA rule?

rule.name == "<RULE_NAME>"

rule.name.matches("Mutation")

rule.name.matches("(XOR)|(MS13_098)")

Regular expressions make a family of rule names one query, which is how you sweep everything an author named consistently. See What is a YARA rule?.

How do I find files by network indicator?

net.hostname == "<HOSTNAME>"

net.hostname.matches("workers.dev")

net.ip == "1.2.3.4"

These match on the hostnames and addresses found inside files, so this is a search for files that reference infrastructure, not a search for traffic. See Network Intelligence.

How do I scope a query to an environment?

object.environment_id == "<ENVIRONMENT_ID>"

object.environment_name == "<ENVIRONMENT_NAME>"

object.authenticode_verification_result == "VALID" && object.environment_id != "<ENVIRONMENT_ID>"

Excluding an environment is how you keep a hunt clear of a corner of your estate you have already accounted for. See Environments.

How do I use this for something less obvious?

The best hunts come from asking what a build leaves behind rather than what a threat looks like.

Binaries that use libcurl carry the string curl.haxx.se inside them, because the library puts it there. So this query finds files built against libcurl, regardless of what the file claims to be:

net.hostname == "curl.haxx.se"

That generalizes. A toolkit, an SDK, a packer, or a build system that stamps a hostname, a PDB path, or a company name into its output has handed you a way to enumerate everything built with it. Narrow that population to what is present in your fleet and already judged badly, and you have a hunt rather than a curiosity:

net.hostname == "curl.haxx.se" && asset.count > 0 && mal_eval.malicious == true

What should I read next?

• CEL Query Language, for every field these examples draw on.
• StairQL, which writes most of the above in a third of the characters.
• Hunting and Search, for turning a query into a saved hunt.