Invoke FalconMalQuery

Invoke-FalconMalQuery

SYNOPSIS

Initiate a Falcon MalQuery YARA hunt, exact search or fuzzy search

DESCRIPTION

Requires 'MalQuery: Write'.

PARAMETERS

Name	Type	Min	Max	Allowed	Pipeline	PipelineByName	Description
YaraRule	String						Schedule a YARA-based search
Type	String			hex ascii wide			Search pattern type
Value	String						Search pattern value
FilterFiletype	String[]			cdf cdfv2 cjava dalvik doc docx elf32 elf64 email html hwp java.arc lnk macho pcap pdf pe32 pe64 perl ppt pptx python pythonc rtf swf text xls xlsx			File type to include with the result
FilterMeta	String[]			sha256 md5 type size first_seen label family			Subset of metadata fields to include in the result
MinSize	String						Minimum file size specified in bytes or multiples of KB/MB/GB
MaxSize	String						Maximum file size specified in bytes or multiples of KB/MB/GB
MinDate	String						Limit results to files first seen after this date
MaxDate	String						Limit results to files first seen before this date
Limit	Int32						Maximum number of results per request
Fuzzy	Switch						Search MalQuery quickly but with more potential for false positives

SYNTAX

Invoke-FalconMalQuery [-Type] <String> [-Value] <String> [[-FilterFiletype] <String[]>] [[-FilterMeta] <String[]>] [[-MinSize] <String>] [[-MaxSize] <String>] [[-MinDate] <String>] [[-MaxDate] <String>] [[-Limit] <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]

Invoke-FalconMalQuery [-YaraRule] <String> [[-FilterFiletype] <String[]>] [[-FilterMeta] <String[]>] [[-MinSize] <String>] [[-MaxSize] <String>] [[-MinDate] <String>] [[-MaxDate] <String>] [[-Limit] <Int32>] [-WhatIf] [-Confirm] [<CommonParameters>]

Invoke-FalconMalQuery [-Type] <String> [-Value] <String> [[-FilterMeta] <String[]>] [[-Limit] <Int32>] -Fuzzy [-WhatIf] [-Confirm] [<CommonParameters>]

SDK Reference

falconpy

PostMalQueryExactSearchV1
PostMalQueryHuntV1
PostMalQueryFuzzySearchV1

USAGE

Schedule a YARA search with hunt

Invoke-FalconMalQuery -FilterFiletypes pe32 -MaxSize 1200KB -FilterMeta sha256, label, family -YaraRule "rule CrowdStrike_16142_01 : wiper { strings: $ = { 41 61 43 63 64 44 65 46 66 47 68 69 4B 4C 6C 4D 6D 6E 4E 6F 4F 70 50 72 52 73 53 54 74 55 75 56 76 77 57 78 79 5A 7A 33 32 2E 5C 45 62 67 6A 48 49 20 5F 59 51 42 3A 22 2F 40 } condition: all of them and filesize < 800KB }"

Search for malware with an exact search

Invoke-FalconMalQuery -FilterMeta sha256, type, size -FilterFiletype pe32, pe64 -MaxSize 1200KB -MinDate 2017/01/01 -Limit 20 -Type hex -Value 8948208b480833ca33f989502489482889782c8bd7

Search for malware with a fuzzy search

Invoke-FalconMalQuery -Limit 3 -Type ascii -Value ".8@bVn7r&k" -Fuzzy

2022-10-24: PSFalcon v2.2.3