Run-to-Ground

Run-to-Ground (RTG) turns a single suspicious hash into a full picture of related activity across your environment. It is built on Variant Discovery, and its purpose is to surface files that evaded detection. Something that landed on the same host at the same time as a file you already distrust, and that almost nothing else in your fleet has, deserves your attention even though nothing flagged it.

What does Run-to-Ground do?

It takes a file hash and works outward from it, asset by asset, to find what else arrived alongside it or alongside anything that resembles it. Specifically, RTG:

1. Starts from your reference hash and finds its variants, and then variants of those variants.
2. Finds which of your assets hold the reference file or any of those variants.
3. For each of those assets, looks at what else landed on that asset around the time the file arrived there, within a 24 hour window on either side.
4. Keeps only the low prevalence files from that window.

Step 4 is the one that matters. Those survivors are the close sightings: files that are rare across your fleet and that showed up on the same machine, at the same time, as something you already distrust. That combination is what a file which evaded detection looks like from the outside.

Note that the window is anchored per asset. It is measured from when the file landed on that particular machine, not from when it first appeared anywhere in your environment, because the arrival time is what makes the co-occurrence meaningful.

Why does step 1 reach further than you would expect?

Because Variant Discovery compares across the entire corpus, both your own private files and the global malware corpus, and it follows variants of variants. That means a file in your environment can be connected to another file in your environment by way of the outside world.

The chain looks like this. File A on one of your machines resembles something that has been seen elsewhere. That outside file has its own relatives. One of those relatives leads back to file B, sitting on a different machine of yours. A and B may not resemble each other closely enough to connect directly, and searching only your own files would never have linked them.

The global malware corpus is what bridges them. It is not a larger haystack to search; it is what tells you what bad looks like, and it carries the relationships that let a local file be recognized as part of something bigger. This is why RTG regularly surfaces machines you would not have thought to look at.

A maximum of 200 objects per variant are displayed.

The prevalence filter in step 4 is what makes the result readable. Plenty of files arrive on a host on any given day and almost all of them are ordinary. The interesting one is rare across your fleet and showed up next to something you already distrust.

RTG is also a key part of Backstory, Stairwell's agentic investigator, which runs this same workflow as one step inside a larger automated investigation.

When should I use Run-to-Ground?

RTG is most valuable during the early stages of incident response and threat hunting:

• Triage a new alert. Start from a single hash flagged by a detection rule and see what else arrived alongside it.
• Scope an intrusion. Determine whether a confirmed malicious file was part of a broader toolset or campaign.
• Hunt proactively. Feed hashes from external threat intelligence into RTG to check for related activity you may have missed.
• Validate clean-up. After remediation, confirm no related variants or co-deployed tools remain in your environment.

How do I run it?

This is the question that trips people up, and the answer is more available than it looks: there is no dedicated Run-to-Ground page to navigate to. RTG is launched from wherever you already are, on whatever hash you are already looking at. If you have been hunting for a menu item, that is why you have not found one.

Two routes cover almost every situation.

Right-click any hash, anywhere. This is the universal one, and the one worth committing to memory:

1. Find a file hash anywhere in Stairwell -- a search result, an object panel, a threat report, a sightings list, a variant list.
2. Right-click the hash to open the Stairwell context menu.
3. Under Workflows, select Run to ground.

Almost every place a hash appears in the product supports this, so "where do I run RTG from" has the same answer as "where am I standing".

From the Variants view. When you are looking at a file's variants, Run-to-Ground is offered directly, without going back to the hash. That is usually the natural next move anyway: you have just found the cluster a file belongs to, and RTG is what tells you where the cluster landed.

Bulk selection, up to 5 hashes:

1. In any list view that supports multi-select, such as search results or threat reports, select the checkboxes next to up to 5 hashes.
2. Right-click any of the selected hashes.
3. Choose Run to ground from the context menu.

From the Chrome extension:

1. Install the Stairwell Chrome extension.
2. When browsing any webpage, recognized hashes are highlighted with an orange gradient.
3. Right-click a highlighted hash and select Run to ground from the Stairwell context menu.
4. Stairwell opens in a new tab and displays the RTG results.

RTG is also available through the API, which is the path to take when you want to sweep a list of hashes from an incident ticket rather than working one at a time.

GET /v1/generateRunToGround:generate

How do I work through a large RTG result?

RTG can return up to 200 objects per variant, and with multiple variants across multiple sightings the result set can become large quickly. A large graph is not a problem, it means Stairwell found significant related activity, but it does require a prioritization strategy.

Start with the reference object's sightings. Before analyzing co-occurring files, confirm how widely the original hash spread across your environment. A hash seen on 200 assets is a different investigation than one seen on a single endpoint.

Filter by verdict first. Prioritize objects with a high malicious likelihood before investigating low-scoring or unscored objects. See Verdicts.

Look for clusters, not individual files. Attackers rarely deploy a single file. Look for groups of unfamiliar objects that arrived within the same narrow time window. Those clusters often represent toolsets or installer packages and are more diagnostic than any individual file.

Treat high-prevalence objects as noise. RTG already filters by prevalence, but if you are still seeing common system files or widespread legitimate software, apply an opinion of Trusted to those objects and run RTG again. The result set comes back cleaner. See Setting Opinions.

Spawn separate investigations for unrelated threads. When RTG reveals a file that warrants its own investigation but is only tangentially related to the original alert, open a new RTG from that hash rather than trying to hold both threads in the same graph. This keeps each investigation scoped and documentable.

A clean result is a finding. If RTG reveals nothing significant, that is meaningful: the suspicious file arrived alone, with no co-deployed toolset and no variants present elsewhere in your environment. Write that down. It narrows the scope of a potential incident and reduces response effort.

What should I read next?

• Variants and Sightings, the two lenses RTG is built out of.
• Prevalence, the filter that makes an RTG result readable.
• Backstory, which runs this workflow as one step of a larger investigation.