Coder Legion - Recent posts tagged malwareanalysis

Stairwell's CTO Built Backstory Around One Question: What's Never Been Seen Before

Fri, 14 Aug 2026 00:38:35 +0000

In 2010, Mike Wiacek was helping lead Google's response to Operation Aurora, the nation-state attack that hit Google and dozens of other companies. At the time, threat intelligence wasn't even a real job category yet. Wiacek says Google wouldn't let him post a job listing asking for candidates with intelligence backgrounds.

That gap is where Stairwell started. Sixteen years, a stint building Chronicle, and one acquisition of VirusTotal later, Wiacek's company has launched Backstory, an agentic investigation platform designed to answer a question most security tools still can't: once you find one piece of malware, what else is out there that looks like it, and how far has it spread?

The problem with logs

Wiacek's argument starts with a flaw he says the entire industry has quietly accepted. Most detection tools are built on logs, and logs only show you activity, not the files themselves.

"Logs are like a CCTV camera that's looking down a hallway in one direction," Wiacek said. Anyone who's watched a heist movie knows how easy that camera is to dodge.

Stairwell's answer is to skip logs and go straight to the source: collect a copy of every executable, driver, and script that touches an enterprise's machines, and store it indefinitely. Wiacek calls it ground-truth data. It lets a security team ask a very specific kind of question — does anything in my environment resemble something no one else in the world has ever seen?

He points to Stuxnet as the example that shaped his thinking. One of its core components was a driver signed with Realtek's private key. If you could ask "does my environment have any signed drivers nobody else has ever seen," and the answer came back yes, you'd have found it. As Wiacek put it, a penguin in Antarctica isn't interesting. A penguin in the Sahara is.

Data lake, then a way to use it

Stairwell has been collecting that file-level data for six years. According to Wiacek, the company now tracks roughly 44 billion file sightings across customer environments, backed by trillions of DNS records and billions of Yara rule matches. The hard part was never getting the data. It was making it usable.

Wiacek compares it to being handed a fully equipped operating room, a donor heart, and the best surgeon's tools available — and still not being able to perform a transplant without the training to use them. Backstory is meant to be that missing layer: it takes Stairwell's file corpus and lets a security engineer ask a plain question, like "I found this, what do I need to do next," and get an answer instead of a dashboard.

What the AI actually does

"Agentic" gets attached to a lot of security products right now, and Wiacek is upfront that a lot of the heavy lifting inside Backstory comes from a fairly conventional rules engine, not a language model. Tokens aren't free, so the system leans on rules where rules are enough.

Where the LLM earns its place is pattern recognition across large, messy graphs. Wiacek's example: a piece of malware talks to a command-and-control domain that's resolved to five different IP addresses over time. Map out everything connected to that domain and you can end up with a graph of 500 nodes and edges. A frontier model can spot a pattern buried in that graph — say, that 67% of the time, the traffic touches one specific network before branching out — that would take a human hours to find by hand, if they found it at all.

He's skeptical of vendors who treat AI as a feature to bolt on. "If you don't give AI data that you didn't already have, you're going to get to the same conclusions faster," he said. Same outcome, just quicker. Stairwell's bet is that the file corpus is the part nobody else has, and the AI is only as useful as what it's reasoning over.

Explainability was a recurring theme. Wiacek said every finding in Backstory comes with the detection rules that matched, where the file spread, and anonymized signals showing how many other Stairwell customers have seen something similar — without exposing who they are. The AI's job, in his framing, isn't to declare something bad. It's to interpret facts a human would otherwise have to piece together from what he described as 30 pages of spreadsheets.

The numbers behind the pitch

Wiacek says a full Backstory investigation — triage, checking for similar files across the fleet, threat intel enrichment, and a containment report — runs about 200 to 250 seconds. He argues the alternative, before Backstory, wasn't a slower version of the same process. It often wasn't possible at all without disk-level forensics, which he described as security teams carrying imaging equipment machine to machine, on a timeline measured in weeks.

"Millions of dollars down to a latte," is how he summed up the shift from a Mandiant-style forensic engagement to what Backstory claims to do per alert.

Where this goes next

Asked what comes after blast-radius mapping, Wiacek described wanting to build something closer to a forecast than a report — modeling where a malware family is likely to spread next, the way meteorologists model storm paths, rather than only reconstructing where it's already been. He compared it, only half-joking, to targeted ads that pick up on a pregnancy before the person searching knows themselves. Creepy, in his words. But he thinks the data Stairwell has already collected puts that closer than most people would guess.

His broader point is less about any one feature. It's that defenders are still budgeting the way they did two years ago, while attackers are already using frontier models to accelerate malware development. "The goal cannot be do what we did before, faster," he said. "We have to do it differently, not just better."

CrowdStrike AI agents reverse engineer malware and prioritize patches without human intervention.

Wed, 17 Sep 2025 21:17:21 +0000

CrowdStrike's Threat AI and Risk-Based Patching: Autonomous Security at Machine Speed

CrowdStrike deploys AI agents that reverse engineer malware and prioritize patches without human intervention.

CrowdStrike announced two capabilities that fundamentally change how organizations handle threat detection and vulnerability management. Threat AI introduces autonomous agents that can reverse engineer malware and hunt threats independently, while Risk-based Patching unifies security and IT operations through intelligent vulnerability prioritization.

Threat AI: Beyond Traditional Threat Intelligence

Traditional threat intelligence requires analysts to manually reverse engineer malware, correlate indicators, and hunt for threats across environments. CrowdStrike's Threat AI automates these workflows using autonomous agents trained on decisions from their Counter Adversary Operations team.

The Malware Analysis Agent can analyze suspicious files, identify code similarities, provide attribution, and generate YARA rules in seconds. This represents a significant shift from the current approach where malware analysis can take hours or days.

The Hunt Agent continuously scans environments for emerging threats, executes queries, and surfaces findings with actionable recommendations. Instead of periodic threat hunting exercises, organizations get continuous autonomous monitoring.

Technical Implementation Details

Both agents operate within CrowdStrike's Threat Intelligence and Hunting modules, leveraging the Enterprise Graph data layer announced yesterday. This architecture allows agents to reason across multiple data sources without requiring custom integrations.

The agents generate YARA rules automatically, which is significant for security teams. YARA rules help detect malware families rather than individual samples, scaling protection across entire threat categories. Manual YARA rule creation requires deep expertise and time that many organizations lack.

The Browser Extension adds contextual intelligence directly into analysts' workflows, providing CrowdStrike's threat data during external research without switching applications.

Risk-Based Patching: Solving the Security-IT Divide

The Risk-based Patching capability addresses a persistent organizational problem: security teams identify vulnerabilities using one set of tools, while IT teams deploy patches using completely different systems. This creates delays that attackers exploit.

CrowdStrike's approach combines Falcon Exposure Management with Falcon for IT to create a unified workflow. Exposure Management identifies which vulnerabilities are most likely to be exploited based on adversary activity and attack paths. The IT module then applies patches with safety controls to prevent system downtime.

The Technical Architecture

The system uses ExPRT.AI scoring to prioritize vulnerabilities based on real-world exploitation likelihood rather than just CVSS scores. This matters because many high-CVSS vulnerabilities are never exploited in practice, while some lower-scored vulnerabilities become active attack vectors.

Patch Safety Scores use sensor intelligence to assess the risk of applying specific patches to individual systems. This helps IT teams understand which systems can be safely patched immediately versus those requiring maintenance windows.

The single-agent architecture means organizations don't need separate tools for vulnerability scanning, patch management, and endpoint protection. Everything operates through the Falcon platform.

Impact on Development and Operations Teams

For development teams, the Threat AI capabilities provide faster feedback on security issues. Instead of waiting for security analysts to manually review suspicious code or indicators, autonomous agents can provide immediate analysis and recommendations.

The unified patching approach simplifies DevOps workflows by eliminating handoffs between security and IT teams. Development teams can see vulnerability priorities and patch status through a single interface rather than coordinating across multiple tools.

Practical Applications

Organizations can now automate threat hunting that previously required dedicated analysts. The Hunt Agent can monitor for specific adversary techniques, emerging malware families, or indicators of compromise without human intervention.

For incident response, the Malware Analysis Agent can provide immediate context when suspicious files are detected. Instead of escalating every unknown file to analysts, the system can quickly determine if it matches known malware families or represents a new threat.

The patching system addresses the common scenario where security teams identify critical vulnerabilities but struggle to get them prioritized by IT teams who lack context about exploitation likelihood.

Security Considerations

The autonomous nature of these systems raises questions about oversight and control. CrowdStrike emphasizes that analysts remain in command, with agents designed to augment rather than replace human decision-making.

The agents operate within predefined rules and can explain their reasoning, which helps maintain accountability. However, organizations will need to establish governance frameworks for autonomous security actions.

Integration with Existing Workflows

The Browser Extension suggests CrowdStrike recognizes that analysts work across multiple tools and platforms. Rather than forcing workflow changes, they're bringing intelligence into existing research processes.

The Model Context Protocol integration announced yesterday means these agents can collaborate with other AI systems, potentially creating more comprehensive automated workflows.

Strategic Implications

CrowdStrike's approach represents a bet that the future of cybersecurity lies in autonomous systems rather than human-operated tools. As attack speeds increase, human response times become insufficient.

The unified platform strategy also positions CrowdStrike to expand beyond traditional cybersecurity into IT operations, potentially competing with established systems management vendors.

Implementation Considerations

Organizations adopting these capabilities will need to retrain security teams to work alongside autonomous agents rather than performing manual analysis. This represents a significant shift in security operations.

The effectiveness of the AI agents depends on the quality of CrowdStrike's training data and threat intelligence. Organizations should evaluate how well the agents perform in their specific environments before relying on them for critical decisions.

Looking Forward

The combination of autonomous threat hunting and intelligent patch prioritization addresses two major pain points in enterprise security. Whether this approach proves effective at scale will depend on how well the AI agents adapt to new threats and how successfully organizations integrate them into existing processes.

For now, the technology provides a clear path toward more automated security operations, potentially freeing human analysts to focus on strategic planning and complex investigations rather than routine analysis tasks.