What Is Stairwell

Stairwell is a malware analysis and retrospective threat hunting platform. It collects the executables and scripts running across your organization, keeps the original files, and re-examines that entire history every time anyone learns something new about what is malicious. The practical effect is that you can ask a question today and get an answer that covers years of files, including files that were deleted from their machines months ago.

What problem does Stairwell solve?

Most security tools are live observers. They judge what is happening right now, using the detection logic they have right now. When something new gets past them, because no rule existed yet or a sensor was offline, that moment is gone. Endpoint telemetry ages out in weeks and logs in a month or two, so the evidence usually expires before anyone knows to go looking for it.

Stairwell keeps the files themselves, which is what makes late knowledge useful. When a vendor publishes a report tomorrow describing an intrusion technique from last spring, you do not have to hope your retention window reached back far enough. The file is still there, and Stairwell applies the new knowledge to it.

What does Stairwell collect?

The files that can carry an attack: executables, scripts, and related artifacts. By default that is roughly 65 file formats, from scripts such as PowerShell, Bash, batch and Lua up through executables, drivers, DLLs, JARs, and other binaries. Documents, spreadsheets, and images are out of scope by default.

That default is a starting point, not a fixed policy. You decide what enters your environment: you can exclude files by path and filename using regular expressions, and you can add file types to widen coverage. Collection reaches the machines you install a forwarder on, and you can also send files directly through the web app or the API.

What can I ask Stairwell that my other tools cannot answer?

Four questions, and most investigations are some combination of them.

• What is this file? Stairwell resolves multiple detection engines, machine learning, and analyst opinion into one verdict, and refreshes it as new intelligence arrives.
• Where has it been, and when? Every observation of a file on one of your machines is a sighting, tied to the asset that saw it and the moment it appeared. Sightings outlive the machine being reimaged.
• How unusual is it? Prevalence tells you how common a file is inside your fleet and across everything Stairwell observes. Present in your fleet and nowhere else in the world is the shape of tooling built for you specifically.
• What else looks like it? An exact hash stops matching the moment an attacker recompiles or repacks. Variants answer a different question, what else resembles this, and return the sibling builds, the repacks, and the later stages.

Is Stairwell a fit for my team?

• SOC analysts get a verdict, a rarity reading, and an analyst-grade summary on a file in seconds, so unknowns get cleared without an escalation.
• Threat intelligence analysts turn a published threat report into standing coverage, and find out immediately whether its indicators have ever been in the fleet.
• Incident responders scope a blast radius from one file: which machines held it, which renamed or recompiled relatives exist, and what rare files landed alongside it.
• Service providers work across a book of customers whose data stays in separate environments, while still being able to check every customer against a new finding.

What does Stairwell not do?

Worth knowing before you plan around the platform.

• Stairwell is not inline and is not a network enforcement point. It does not block execution or drop traffic. It tells you what happened and how far it reached.
• Stairwell is not a replacement for your EDR. It runs alongside it, and analysis happens in Stairwell rather than on the endpoint, which is why it covers the history and the file formats an endpoint agent cannot afford to keep.
• Stairwell has some detonation, but it is not a full sandbox.
• Stairwell does not touch your network. No packet capture, no netflow, no traffic interception. Network intelligence is derived from files and from public feeds.
• Stairwell does not collect every file on a machine. It collects the formats described above, and you tune that set.

Beyond a single file, the same retained history is what makes incident scoping, malware similarity analysis, YARA retrohunts across years of files, and historical DNS lookups on the infrastructure inside those files answerable at all. See What Stairwell Knows About a File for the full inventory.

What should I read next?

• How Stairwell Works, for the whole product in one page: where files come from, what happens to them, and how you ask questions of them.
• Your First Fifteen Minutes, if you have an account already and want something concrete to do with it.
• Meet Backstory, for the investigator that runs these moves on your behalf.