Invoke FalconMalQuery

Invoke-FalconMalQuery

SYNOPSIS

Initiate a Falcon MalQuery YARA hunt, exact search or fuzzy search

DESCRIPTION

Requires 'MalQuery: Write'.

PARAMETERS

Name	Type	Min	Max	Pattern	Allowed	Pipeline	PipelineByName	Description
YaraRule	String					False	False	Schedule a YARA-based search
Type	String				hex ascii wide	False	False	Search pattern type
Value	String					False	False	Search pattern value
FilterFiletype	String[]				cdf cdfv2 cjava dalvik doc docx elf32 elf64 email html hwp java.arc lnk macho pcap pdf pe32 pe64 perl ppt pptx python pythonc rtf swf text xls xlsx	False	False	File type to include with the result
FilterMeta	String[]				sha256 md5 type size first_seen label family	False	False	Subset of metadata fields to include in the result
MinSize	String					False	False	Minimum file size specified in bytes or multiples of KB/MB/GB
MaxSize	String					False	False	Maximum file size specified in bytes or multiples of KB/MB/GB
MinDate	String			^\d{4}/\d{2}/\d{2}$		False	False	Limit results to files first seen after this date
MaxDate	String			^\d{4}/\d{2}/\d{2}$		False	False	Limit results to files first seen before this date
Limit	Int32					False	False	Maximum number of results per request
Fuzzy	Switch					False	False	Search MalQuery quickly but with more potential for false positives

SYNTAX

Invoke-FalconMalQuery [-Type] <String> [-Value] <String> [[-FilterFiletype] <String[]>] [[-FilterMeta] <String[]>] [[-MinSize] <String>] [[-MaxSize] <String>] [-MinDate] <String>] [[-MaxDate] <String>] [[-Limit] <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]

Invoke-FalconMalQuery [-YaraRule] <String> [[-FilterFiletype] <String[]>] [[-FilterMeta] <String[]>] [[-MinSize] <String>] [[-MaxSize] <String>] [[-MinDate] 
<String>] [[-MaxDate] <String>] [[-Limit] <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]

Invoke-FalconMalQuery [-Type] <String> [-Value] <String> [[-FilterMeta] <String[]>] [[-Limit] <Int32>] -Fuzzy [-WhatIf] [-Confirm] [<CommonParameters>]

Generated 20220922 using PSFalcon v2.2.3