Beyond AV: Detection-Oriented File Analysis
summary
Argues for adding detection-oriented file analysis into detection stacks by showing a working system: Strelka, a Python + 0mq + protobuf pipeline that produces JSON metadata, extracts nested files, and scales to 150 million files a day (≈3 TB) with 95th-percentile scans at ~13–14s and subsecond at lower percentiles. Demonstrates on a resume DOCX that Strelka unpacks 18 parts, surfaces VBA strings, a Python one-liner, a Mac launch-agent plist that persists code and uploads data — despite only 6 of 59 AV engines flagging it.
AI-written summary · about
chapters (6)
related talks
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
47m Natural Language Processing & Anomaly detection in Sys call logs
31mUsing Math to Speed Up Security Assessments of Windows Executables
23mPython for Threat Intelligence
22mMalware Hunting - Using python as an attack weapon
30mTrawling for IOCs: Catching C2 in a Sea of Data
27mA Machine Learning approach for detecting a Malware
41mHow AI Is Changing the Malware Landscape