I’m excited to share that I’ll be speaking at MITRE ATT&CKcon 7.0, October 27–28, 2026, at MITRE in McLean, VA and online.
My talk, From Strings to Techniques: AI-Augmented Malware Analysis with MalChela and Claude Desktop, looks at what happens when you give an AI co-analyst real tools instead of just a chat window. Using MalChela’s MCP server integration with Claude Desktop, I’ll walk through a workflow that goes from raw string extraction to ATT&CK-mapped findings, synthesizes results across multiple tools, and ends with something defenders can actually use: detection content.
Expect a practical look at:
ATT&CK-mapped string analysis with mStrings, turning noise into techniques
Cross-tool synthesis, letting the co-analyst correlate output from tiquery, fileanalyzer, and more
Closing the loop, from static analysis to YARA and Sigma rules ready for detection engineering
If you’re going to be in McLean, come say hello. I’m always up for talking DFIR, malware, open-source tooling, or where AI fits (and doesn’t) in our workflows. If you can’t make the trip, ATT&CKcon offers virtual attendance, so you can still catch the talk and the rest of a great lineup.
Some of you found your way to Baker Street Forensics because you’re Sherlockians first, and forensicators second. An unfathomable number of you showed up just for the ‘Lack Rack’. And the rest of you, my trusted readers as King would say, are probably wondering what any of this has to do with disk images and timelines.
Nothing. That’s the point.
I think everyone who’s worked in DFIR long enough has entertained some version of the same fantasy: going completely off-grid with a a well-stocked library, pantry, and bar – with nothing to do with technology except a bank of solar panels. I’ve certainly spent my share of incident-response nights thinking about it.
But there’s a second fantasy that’s been living rent-free right alongside it: retiring someday and opening a Sherlock-themed bar. Until that day arrives, or a wealthy patron steps forward to fund it, the 221B Bar exists online.
221b.bar is a growing compendium of Sherlockian cocktails, drinks named after cases, characters, and canon riffs, with a proper Baker Street atmosphere to match. A bit of a hobby, a bit of a pipe 💨 dream, but I’d love for you to visit.
The menu has a search function, and a “What’s in your Bar” option, so you can select the spirits you already have on hand, and it will show you which cases, and which recipes, you’re able to build – or if you’re just an ingredient or two shy.
There’s also a corner reserved in homage to the dwindling number of Pipe smokers, and those whose memories can be sparked by an aroma.
Stop by and have a drink with us. Aspiring mixologists are welcome to participate.
Hot on the heels of v4.2… yep, v4.3. What can I say? The melatonin isn’t cutting it anymore to keep me asleep. Rather than count sheep – working on my favorite project helps. Granted I’ve still got bags under my eyes, but I’ve got something to show for it.
At A Glance
The first thing you’ll notice on this release, after all it’s impossible to miss, the At A Glance panel added to the Home Screen. In addition to the “Crabby Koans“, you see:
Number of open/closed cases
API key status
Number of MalChela tools loaded
Number of Integrations (3rd party tools) loaded; great for REMnux mode
GitHub status for available updates (it’s back!)
Other UI enhancements include new Analyze and Cases toolbar buttons, a collapsible Tools sidebar; and live progress updates during a run.
Airplane Mode / Offline Mode
While there’s a lot of great threat-intel information you can garner using TIQuery and the other utilities, sometimes internet isn’t an option – or maybe it’s a sample you want to handle so carefully you want to ensure there’s no external lookup activity. MalChela won’t mess with your Op-Sec. Rather than just have things fail gracefully (hopefully) when there’s no internet, there’s now a new Offline Mode toggle (Configuration screen), that cleanly skips every network call across the toolkit (NSRLQuery, TIQuery’s full multi-source lookup, FileAnalyzer’s VirusTotal + NSRL checks) instead of failing quietly or hanging, so labs and scenarios can run fully air-gapped.
Analyze Rollup
Triage Summary now links directly to the relevant section for flagged malicious files and their flags/indicators, plus the Filesystem and Network IOC lists — click a finding, jump straight to the detail.
Network IOCs in the rollup are shown defanged by default, with a note clarifying that links jump to the report section rather than the live URL.
Case ZIP/archive samples and containers found mid-scan (not just top-level) are now auto-extracted and analyzed automatically.
Includes the new dpp Extract tool: unwraps DMG/PKG containers to reach the real payload files inside.
mStrings
As the tools and the suite continue to grow, mStrings remains the star of the show. Updates in this release include:
Network IOCs in mStrings’ own report output are now defanged, matching the rollup.
Base64 strings are now auto-decoded and recursively rescanned for further IOCs/detections.
Regex engine switched to fancy-regex, enabling lookaround-based detection patterns.
Better surfacing of bare-domain C2 IOCs and multi-layer obfuscation depth.
The Base64 scanning is impressive. On one of my test samples MalChela was able to extract strings in a file buried under 8 layers of Base64 encapsulation.
StringsToYARA
New refang capability: defanged URLs (hxxp://, [.]) in source strings are automatically restored to real URLs in the generated YARA rule.
Safely store your URLs in a defanged state – when it’s time to create the rule – then and only then does the live url get exposed.
Detections
25 new detection rules added (bringing the ruleset to 144), including full coverage for the Proton macOS RAT family, XCSSET, iWorm, EmPyre, Bella RAT, BirdMiner, and Python self-decompressing execution patterns.
Documentation
Full documentation pass covering all of the above, plus a new Offline Mode reference page and a Top Toolbar quick-reference table.
Bonus for me, the PDF User Guide is now generated via an automated, versioned build pipeline.
I’m excited to announce that v4.2 of MalChela is now available. While it may not be “the Answer to the Ultimate Question of Life, the Universe, and Everything,” or even The Malware Analysts Guide to the Galaxy, it does have some great new functionality.
This release has two big themes. First, the Mac side of the house — four tools now speak fluent .app bundle instead of making you dig out the binary inside Contents/MacOS/ yourself.
Second, and bigger: there’s a new way to run MalChela that doesn’t start with “which tool do I need for this file again?” It’s called Analyze, and it’s the closest thing this project has had to a an easy button.
Mac app bundle support (“Mac Stack”)
If you’ve ever pulled a .app bundle into MalChela before, you know the drill: find the actual binary buried in Contents/MacOS/, feed that to whatever tool you’re running, and hope you resolved the right one. That workaround is gone. Four tools now understand .app bundles directly — point macho_info, codesign_check, mstrings, or plist_analyzer at the bundle itself and they auto-resolve the main executable (via CFBundleExecutable, falling back to the sole binary in Contents/MacOS/ when needed).
What each one is actually looking for:
macho_info — architecture, PIE/ASLR, __PAGEZERO, linked libraries, per-section entropy. It flags deprecated/EOL crypto libraries, RPATH entries (a classic dylib-hijacking setup), and the CoreFoundation+SystemConfiguration+Security dylib triad that shows up disproportionately often in C2 implants.
codesign_check — signature status (Developer-signed / Ad-hoc / Unsigned), Bundle ID, Team ID, entitlements, and the get-task-allow flag (a tell for debug builds). It also catches Team ID mismatches between a bundle’s signer and its main executable’s signer — a supply-chain / hijack indicator that’s easy to miss by eye.
plist_analyzer — flags LSUIElement/NSUIElement (an app hiding itself from the Dock), NSAllowsArbitraryLoads (App Transport Security turned off), custom CFBunda missing CFBundleSignature, and missing orextra binaries inside Contents/MacOS/.
mstrings — now scans Mach-O binaries and bundles directly, with the same bundle-to-executable auto-resolution as the rest of the stack.
More Mac-specific detections are already in the pipeline for upcoming releases, so consider this the foundation, not the ceiling.
Analyze — one-click auto-triage
Point Analyze at a file, a folder, or a .app bundle, and it classifies everything with FileMiner, then automatically dispatches every tool FileMiner suggests for each file it finds. No more running FileMiner, reading the suggested-tools column, and manually kicking off each one yourself — Analyze closes that loop for you. It’s available in both the PWA and as a new analyze tool in the MCP server, so if you’re driving MalChela through Claude, the same triage workflow is one call away.
A couple of details worth knowing:
Save to Case works exactly like every other tool panel — checkbox plus case dropdown, opt-in. On the MCP side, it follows the same rule as every other MCP tool: you need an active case (set_case) before Analyze will run, which keeps the behavior consistent across the whole server rather than special-casing this one workflow.
Concise Output is on by default and renders the rollup report inline instead of the full expanded per-tool output — good default for a first pass, and easy to turn off if you want to see everything each tool produced.
The MalChela Summary rollup report
Every Analyze run produces one malchela_summary_<timestamp>.md, saved alongside the individual tool reports it’s summarizing. The goal here wasn’t just “concatenate the output” — it’s a real triage document, and it leads with a summary banner built to answer the questions you’d actually ask first:
How many files, really? File counts, with automatic grouping of duplicate content — if the same bytes show up under five different filenames (extremely common with carved or exported artifacts), you get one write-up instead of five identical ones.
Is anything flagged? Malicious verdicts pulled from VirusTotal, cross-referenced across both FileAnalyzer and tiquery — which matters more than it sounds like, since FileAnalyzer isn’t run against Mach-O files, so tiquery is what keeps Mac samples from falling through the cracks.
What is it? Malware family and tag names pulled straight from tiquery’s multi-source lookups.
What does it do? MITRE ATT&CK findings from mstrings, totaled and broken down by tactic, so you can see at a glance whether you’re looking at something built for persistence, defense evasion, discovery, or all of the above.
What did it touch or talk to? Filesystem and network IOCs surfaced by mstrings.
What’s structurally off? Flags and indicators from macho_info, plist_analyzer, and codesign_check — the RPATH entries, hidden-Dock plists, and Team ID mismatches mentioned above, all rolled up in one place.
Below the summary, each file gets its own section with every tool’s actual formatted report embedded — real tables, real headers, not a wall of raw console output. It reads cleanly whether you’re looking at it in the PWA or opening the file on its own.
Douglas Adams never actually tells us what the Question is — just the Answer. v4.2 doesn’t have that problem. The question was always “what’s actually in this sample,” and now Analyze, the Mac Stack, and the MalChela Summary answer it in one pass instead of five.
