Introducing StealerLens: An LLM-Powered Forensics Microscope to Accelerate InfoStealer ...
summary
StealerLens is an LLM‑powered forensics microscope that ingests single infection stealer logs (average 2.3 MB, ~30 files) and returns a ranked infection hypothesis in 1–3 minutes; pipeline uses per-artifact prompts (history, processes, system, clipboard, screenshots), a screenshot stage with perceptual-hash ad filter, structured outputs via pyantic-structured JSON, and runs on AWS Bedrock; early tests flag 21/25 logs correctly and access is gated to verified practitioners.
AI-written summary · about
chapters (11)
- 0:00Welcome to StealerLens
- 1:26Info stealer malware basics
- 7:03Manual stealer log challenges
- 8:09StealerLens architecture design
- 11:22Prompt engineering for artifacts
- 17:46Screenshots and ad filtering
- 21:16Master prompt and hypothesis
- 25:27Live demo of StealerLens
- 27:13Security and access control
- 29:44Conclusion and future work
- 30:52Q&A
related talks
43mInfostealer Log Injection — a Potential Form of Information Flow Control
17mOSINT to Compromise
33mSpeed is key: Leveraging the Cloud for Forensic Artifact Collection & Processing
56mAutomating Linux Malware Analysis Using Limon Sandbox
20mLeveraging Osquery for DFIR at Scale
32mHey Attacker! I Can See You!
40mWhat Does an LLM-Powered Threat Intelligence Program Look Like?
27mSecuring The Gateway And Mitigating Risks In LLM API Integration