# AI Lowers the Barrier to Reverse Engineering Mainstream Software and Malware (Intezer: Slack, Apple Finder, Turla)

> Dark Reading reports Intezer research showing AI-assisted reverse engineering lowers the skill needed to rebuild proprietary software and malware. Researchers rebuilt Slack and Apple's Finder with only moderate difficulty and produced a working Turla replicant, raising IP-theft and cyber-defense concerns.

- **Published:** 2026-11-10T13:15:10Z
- **Last reviewed:** 2026-11-10T14:59:35.919Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5646
- **ID:** TL-2026-5646
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

This is a trend and research item, not an exploited vulnerability. Per Dark Reading's coverage of Intezer research (researcher quoted: Nicole Fishbein), the team tested AI-assisted reverse engineering against three targets: Slack, Apple's Finder app, and the Turla malware.

Slack was the easier target because it offered little that the researchers could not unpack by reverse-engineering its JavaScript source code. Finder was harder because it relies on files managed by cloud services and on actions whose results depend on other macOS services. Rebuilding Apple's and Salesforce's proprietary applications from the ground up was reported as only moderately difficult. Turla malware proved the most difficult to wrangle, yet Fishbein and a colleague ultimately built a Turla replicant with its full working pipeline: how it receives and executes commands, and its file transfer mechanisms.

The stated implications are intellectual-property theft (cloning proprietary apps) and effects on cyber defense, since AI shortens the time and skill needed to analyze malware and, by extension, to reproduce it. The article also notes that even a straightforward reproduction of the Slack client would not recreate its entire implementation, so vendors may need to be more careful with their intellectual property without assuming full cloning is trivial.

VERIFICATION LIMITS: direct fetch of the Dark Reading article returned HTTP 403 and Intezer's primary write-up could not be located, so details come from search-result excerpts only. The article date of 2026-11-10 comes from a search-result description. No CVE, IOC, CVSS, exploitation status or malware-sample hashes were verified. No network indicators exist to correlate in BeaconBeagle.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1587.001 Develop Capabilities: Malware
- T1059 Command and Scripting Interpreter
- T1105 Ingress Tool Transfer
- T1070.004 Indicator Removal: File Deletion

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Turla-Style Reconnaissance Burst from a Single Parent Process (TL-2026-5646)** (`TL-2026-5646-SPL-002`)

Detects four or more distinct built-in reconnaissance utilities (systeminfo, ipconfig, netstat, tasklist, whoami, net, nltest, arp, nbtstat) launched by one parent process within five minutes. This is the operator-driven command receive-and-execute pattern that Intezer's Turla replicant reproduces (TL-2026-5646). The pattern is generic hands-on-keyboard discovery rather than a Turla-unique signature.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.003, T1082, T1016, T1033, T1057
- **Data sources:** Sysmon EventCode 1 (index=sysmon), Microsoft Defender for Endpoint DeviceProcessEvents
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval tool=lower(OriginalFileName)
| where match(tool,"^(sysinfo|ipconfig|netstat|tasklist|whoami|net|net1|nltest|arp|nbtstat)[.]exe$")
| fillnull value="" ParentCommandLine ParentImage ParentProcessGuid
| bin _time span=5m
| stats dc(tool) as distinct_tools values(tool) as tools values(CommandLine) as commands by host ParentProcessGuid ParentImage ParentCommandLine _time
| where distinct_tools>=4
| table _time host ParentImage ParentCommandLine distinct_tools tools commands
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("systeminfo.exe", "ipconfig.exe", "netstat.exe", "tasklist.exe", "whoami.exe", "net.exe", "net1.exe", "nltest.exe", "arp.exe", "nbtstat.exe")
| summarize distinct_tools = dcount(tolower(FileName)), tools = make_set(tolower(FileName), 20), commands = make_set(ProcessCommandLine, 20), first_seen = min(Timestamp) by DeviceName, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 5m)
| where distinct_tools >= 4
| order by first_seen desc
```

### Sigma

```yaml
title: Turla-Style Reconnaissance Utility Burst (Base)
name: tl_5646_recon_tool_exec
id: e51a9c28-4d07-4b3e-8f62-a7c0b9d15e04
status: experimental
description: Base rule matching built-in Windows reconnaissance utilities by original file name. Used by the correlation rule below.
references:
    - https://www.darkreading.com/application-security/ai-reverse-engineering-apps
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.discovery
    - attack.t1082
    - attack.t1016
    - attack.t1033
    - attack.t1057
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        OriginalFileName:
            - 'sysinfo.exe'
            - 'ipconfig.exe'
            - 'NETSTAT.EXE'
            - 'tasklist.exe'
            - 'whoami.exe'
            - 'net.exe'
            - 'nltest.exe'
            - 'arp.exe'
            - 'nbtstat.exe'
    condition: selection
falsepositives:
    - Used only through the correlation rule
level: informational
---
title: Turla-Style Reconnaissance Burst from a Single Parent Process
id: 0a7d3f95-c86b-4e12-9b40-5d2e8a1f6c05
status: experimental
description: Four or more distinct reconnaissance utilities launched by the same parent process within five minutes, consistent with operator-driven command execution reproduced in the Turla replicant research (TL-2026-5646).
references:
    - https://www.darkreading.com/application-security/ai-reverse-engineering-apps
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.discovery
    - attack.execution
    - attack.t1059.003
    - attack.t1082
    - attack.t1016
    - attack.t1033
    - attack.t1057
correlation:
    type: value_count
    rules:
        - tl_5646_recon_tool_exec
    group-by:
        - ParentProcessGuid
    timespan: 5m
    condition:
        gte: 4
        field: OriginalFileName
falsepositives:
    - IT admin troubleshooting scripts and inventory tools
    - Endpoint management agents running discovery batches
level: medium

```

**Known false positives:**

- IT troubleshooting scripts and inventory agents that run several of these tools together
- Vulnerability scanners and EDR response actions that collect system information

**Tuning notes:** Exclude known management-agent parent images such as SCCM, Tanium and Rapid7. Raise distinct_tools to 5 for noisy estates. Prioritise hits where the parent is a scripting host, an unsigned binary or a user-writable path.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Reverse-Engineering Tooling Host with LLM API Egress (AI-Assisted RE, TL-2026-5646) (locked: unlock with TL Creds)
- Interpreter-Hosted Command Receive-and-Execute Pipeline (Turla Replicant Behaviour, TL-2026-5646) (locked: unlock with TL Creds)
- Interpreter- or LOLBin-Dropped Payload Executed from User-Writable Path (File Transfer, TL-2026-5646) (locked: unlock with TL Creds)
- macOS Binary Inspection Tools Run Against Finder or Slack Bundles (TL-2026-5646) (locked: unlock with TL Creds)
- Chained Reconnaissance Commands in a Single cmd.exe Invocation (Turla-Style, TL-2026-5646) (locked: unlock with TL Creds)
- Agent.btz Publicly Reported File Artifacts (Turla-Linked Background, TL-2026-5646) (locked: unlock with TL Creds)
- Slack Electron App ASAR Unpack / JavaScript Deobfuscation (AI-Assisted Reverse Engineering, TL-2026-5646) (locked: unlock with TL Creds)
- Periodic HTTP POST Beaconing to a Single Destination (C2 Pipeline, Turla Replicant, TL-2026-5646) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [AI Makes Reverse Engineering Mainstream Software & Malware Easy](https://www.darkreading.com/application-security/ai-reverse-engineering-apps)
- [Intezer Research](https://research.intezer.com/)
- [Bringing Reverse Engineering to the Frontline of SecOps - Intezer](https://intezer.com/blog/reverse-engineering-frontline)
- [Mapping the Connections Inside Russia's APT Ecosystem - Intezer](https://www.intezer.com/blog-russian-apt-ecosystem/)
- [New Variants of Agent.BTZ/ComRAT Found (Part 2/2) - Intezer](https://intezer.com/new-variants-of-agent-btz-comrat-found-part-2/)
- [Russian-Speaking Turla Group Uses New Tools to Target Embassies, Consulates - Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/russian-speaking-turla-group-uses-new-tools-to-target-embassies-consulates)
- [Turla / Pensive Ursa Threat Assessment - Unit 42](https://unit42.paloaltonetworks.com/turla-pensive-ursa-threat-assessment.md?web_view=true)
- ['Reverse-Engineer Anything' Is the New Wild West of AI - 404 Media](https://www.404media.co/reverse-engineer-anything-is-the-new-wild-west-of-ai/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5646