Variants

A variant is a file that resembles another file closely enough that the two are worth investigating together: the same tool rebuilt, the same payload repacked, an earlier version, a sibling from the same family, the second stage a dropper was carrying. Variant Discovery is the capability that finds them. It identifies content and structural overlap between files across the entire corpus, both your own private files and the global malware corpus, and returns a ranked list of the files that most confidently belong with the one you started from.

When is a variant useful?

The moment a hash stops being useful, which is sooner than most workflows assume. An alert hands you one file. You look up its hash, find nothing else anywhere, and the investigation is over before it started. That dead end is not a sign that the file is a one-off. It is a sign that the adversary rebuilt, repacked, or obfuscated their tool since the last time anyone wrote its hash down, which costs them minutes and costs you the entire lead.

Variants answer a different question. Not "where else is this exact file", which is a question about bytes, but "what else looks like this", which is a question about the thing the bytes implement. From one sample you get the sibling builds, the repacks, the earlier versions, and the related payloads, ranked by how confidently each one belongs. An adversary who wants to hide from that has to change what their tool is, not merely what it compiles to.

Why searching your own files is not enough

Here is the part that makes Variant Discovery different from a similarity search over your own environment, and it is the reason the global malware corpus matters.

Similarity is not only a direct comparison between two files. It is something you can travel along. Consider a chain that happens routinely:

A malicious file A sits in your private environment.
A has a variant in the global malware corpus.
That global variant has its own variants in the global corpus.
One of those leads back to a distant file B, sitting in your own private environment.

B is now known to be related to A, and you have learned it without ever having a reason to suspect B. Compare A and B to each other directly and they do not resemble each other closely enough to connect. The global corpus is what bridged them: two of your own files, linked through the world's.

This is why the global malware corpus is not merely a bigger haystack. It is the source of reasoning about what bad looks like. An organization comparing only its own files can learn that two of its files resemble each other. An organization whose files are compared across both corpora can learn that a file nobody suspected belongs to a family that has been seen elsewhere in the world, and can find the rest of that family sitting quietly in its own estate. More context means more awareness of what is bad, both globally and inside your own environment.

Two honest limits. Similarity is a lead, not a verdict: two builds of the same benign installer are near-identical, and a variant of a malicious file still needs a verdict of its own. And what you see always respects environment boundaries, so a variant in an environment you cannot read is never surfaced to you.

When does Variant Discovery run?

It runs automatically where the answer is always needed, and on demand everywhere else.

Automatically, it runs for threat reports, so a report's results include the related files its author never listed, and inside Backstory investigations, so an investigation expands from an indicator to the family without anyone asking it to.

On demand, you ask for it: open a file's Variants section in the web app, or call the API. It does not run against each file at the moment that file is collected, so treat it as a lens you point at a file rather than a field stamped on one.

What do I do with a variant?

Widen a dead-end lead. One hash becomes the cluster it belongs to. This is the move that turns "the file matched nothing" into "here are eleven related files, four of which we have already judged".
Reuse a judgment you already made. If your team marked any file in the cluster Malicious or Trusted, that opinion is visible on the variant list, and it often settles the new file in seconds.
Sort for the interesting end. The list sorts by Similarity, Prevalence, Maliciousness, and First seen. Rare variants with a bad verdict are where to start; the common ones are usually shared libraries and packers.
Scope the incident. Take the cluster to sightings and find every asset that saw any member of it, not only the one file the alert named.
Write better detection. A cluster of related samples is the raw material for a rule that catches the family instead of the sample. See What is a YARA rule?.
Compare a variant against the original. The detail pane shows the YARA matches for the original next to the ones for the variant you selected, which is a fast way to see what the two files share.

Where do I see variants in Stairwell?

The Variants section of the object panel. A list of the related files with their similarity, prevalence, verdict, and opinion, and a detail pane for whichever one you select, where you can run triage on it or set an opinion without leaving the investigation.
The Variants list in a threat report panel, alongside the report's Summary, Matches, and IOCs tabs.
Backstory investigations, where variant expansion is part of how an investigation grows from one indicator to a scoped picture.
Run-to-Ground results, which expand across variants so a tool renamed or recompiled on a second host does not escape the sweep.
The Variants view itself, which offers Run-to-Ground on the spot. Having found the cluster, the next question is usually where it landed, and that is one action away rather than a separate destination.

What should I read next?

Prevalence, which tells you which members of a variant cluster are worth your time.
Run-to-Ground, the workflow that combines variants, sightings, and rarity into one blast-radius picture.
What is a YARA rule?, for turning a cluster you found into detection that keeps working.