What Stairwell Knows About a File
The complete inventory of what Stairwell extracts, computes and remembers about a single file -- structure, signing, content, relationships, similarity, rarity, infrastructure, enterprise context and AI analysis -- and how those signals combine.
Every other page here explains one signal. This one is the inventory: everything Stairwell derives from a single file, in one place, so you can tell at a glance whether a question you have is answerable.
The organizing fact is that these are not separate products. They are layers over the same retained bytes, which is what lets a question start in one layer and be answered in another -- a hostname pulled from a binary becomes a resolution timeline, which becomes a list of other files, which becomes a list of your machines.
The inventory
| Layer | What Stairwell gives you |
|---|---|
| Identification | SHA-256, SHA-1 and MD5; size; detected file type and architecture; timestamps; PE version metadata where the file carries it |
| Executable structure | Sections, imports, exports, and the capabilities identified in the file, for PE, ELF and Mach-O alike |
| Code signing | The certificate chain and signer, and whether the signature actually verifies -- not merely whether one is present |
| Content | Extracted strings, the raw bytes in a hex view, and a binary image that makes packing and encryption visible at a glance |
| Embedded infrastructure | The hostnames and IP addresses written inside the file |
| Relationships | Parents and children: the archive or installer a file came out of, and everything extracted from it |
| Similarity | Variants -- the files that resemble this one across both your private files and the global malware corpus, ranked |
| Rarity | Prevalence, locally across your fleet and globally across the environments Stairwell observes |
| Detection | YARA matches, rule by rule, and matches against threat reports available to your environments |
| Verdict | One verdict with confidence and labels, resolved from multiple engines, machine learning and analyst opinion |
| Enterprise context | Sightings per asset and per moment -- which machines, which paths, which filenames, first and last seen |
| Dynamic behavior | The hostnames and addresses the file reaches out to during behavioral analysis. Beta, and see the limit below |
| Historical infrastructure | For each embedded hostname, its full resolution history and the other names sharing its addresses. See Hostnames and IP Addresses |
| AI analysis | AI Triage: a written assessment with malicious likelihood, confidence, a specific threat type, the indicators worth pivoting on, and a MITRE ATT&CK mapping tied to observed behavior |
| Your team's judgment | Opinions, comments and tags, which outrank the automated verdict inside your environment |
| Audit trail | Every recorded change on the object: who decided what, when, in which environment, and what it was before |
Most of this is on the object panel, which is where you will actually read it. Not every layer appears on every file -- the format tabs show up only for the formats they describe, and a few depend on what your organization has enabled.
What is derived versus remembered
Worth separating, because it determines what changes without you doing anything.
Derived from the bytes, and therefore stable unless the file changes: identification, structure, signing, strings, embedded infrastructure, relationships, the binary image.
Computed against a corpus, and therefore changing as the corpus does: variants, prevalence, YARA matches, threat report matches, the verdict. A file that matched nothing when it arrived can match a rule written next year, because the rule is evaluated against files already collected.
Recorded from your environment, and growing as your fleet reports: sightings, assets, paths, filenames, first and last seen.
Written by analysis, and re-run as evidence accumulates: AI Triage, and the verdict it can feed.
The practical consequence is that a file's page is not a snapshot of what was known on the day it landed. Coming back to a file six months later is a different read, without anyone re-submitting it.
How the layers combine
Individually these are facts. The value is in the joins, and three are worth knowing by name.
Structure plus similarity gives you family, not just file. An exact hash stops matching the moment an adversary recompiles. What survives is what the code is, which is what Variant Discovery compares -- so one hash becomes the cluster it belongs to, each member carrying its own verdict, prevalence and opinion.
Content plus historical infrastructure gives you dates. A hostname inside a binary is a string. The same hostname with a resolution history tells you when the infrastructure was live, which is what turns "we held a suspicious file" into "we held it while its infrastructure was answering, on these dates" -- the form your network team can actually search logs for.
Rarity plus enterprise context gives you triage order. A file almost nothing in your fleet has, which arrived on a machine within hours of something you already distrust, is the shape of tooling that evaded detection. No alert required, and that single join is what Run-to-Ground automates.
Honest limits
- Stairwell is not a disassembler or a debugger. It gives you structure, capabilities, strings and an analyst-grade written assessment. It does not hand you a decompilation, and deep manual reverse engineering still happens in your own tooling.
- Detonation is beta, and Stairwell is not a full sandbox. Read what it reports as an addition to static evidence, not a complete behavioral profile.
- Resolution history is not connection history. Stairwell knows where a name pointed and when. It does not know that a machine of yours reached it.
- Analysis is out of band. Files are analyzed after collection, in your environment, not inline on the endpoint. Stairwell explains and finds; it does not block.
What should I read next?
- The Object Panel, for where each of these appears on screen and the order to read them in.
- How Stairwell Works, for why the bytes are retained and what that makes possible.
- AI Triage, for the layer that synthesizes the rest into a written assessment.
- Run-to-Ground, for expanding one file into an incident.
Updated about 3 hours ago