MalQuery

Search the CrowdStrike malware repository using YARA rules, exact searches, and fuzzy searches to identify and analyze malicious files.

Cmdlets

Get-FalconMalQuery

Verify the status and results of an asynchronous Falcon MalQuery request, such as a hunt or exact-search. Permissions: MalQuery: Read

string

required

Request identifier (UUID format)

Example

# Check the status of a MalQuery hunt
Get-FalconMalQuery -Id 'a1b2c3d4-e5f6-7890-abcd-ef1234567890'

Get-FalconMalQueryQuota

Retrieve Falcon MalQuery search and download quotas. Permissions: MalQuery: Read

Example

# Check your MalQuery quota usage
Get-FalconMalQueryQuota

Get-FalconMalQuerySample

Retrieve Falcon MalQuery indexed file metadata. Permissions: MalQuery: Read

string[]

required

SHA256 hash value

Example

# Get metadata for a specific sample
Get-FalconMalQuerySample -Id 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'

# Get metadata for multiple samples
$Hashes = @(
    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
    'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2'
)
Get-FalconMalQuerySample -Id $Hashes

Group-FalconMalQuerySample

Schedule MalQuery samples for download. Permissions: MalQuery: Write

string[]

required

SHA256 hash value

Example

# Schedule samples for batch download
$Samples = @(
    'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
    'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2'
)
Group-FalconMalQuerySample -Id $Samples

Invoke-FalconMalQuery

Initiate a Falcon MalQuery YARA hunt, exact search, or fuzzy search. Permissions: MalQuery: Write

string

Schedule a YARA-based search

string

Search pattern type. Valid values: hex, ascii, wide

string

Search pattern value

string[]

File type to include with the result. Valid values:

cdf, cdfv2, cjava, dalvik
doc, docx, elf32, elf64
email, html, hwp, java.arc
lnk, macho, pcap, pdf
pe32, pe64, perl, ppt, pptx
python, pythonc, rtf, swf
text, xls, xlsx

string[]

Subset of metadata fields to include in the result. Valid values: sha256, md5, type, size, first_seen, label, family

string

Minimum file size specified in bytes or multiples of KB/MB/GB

string

Maximum file size specified in bytes or multiples of KB/MB/GB

string

Limit results to files first seen after this date (format: YYYY/MM/DD)

string

Limit results to files first seen before this date (format: YYYY/MM/DD)

int32

Maximum number of results per request

switch

Search MalQuery quickly but with more potential for false positives

Example

# Execute a YARA hunt
$YaraRule = @'
rule RansomwareDetection {
    strings:
        $s1 = "encrypted" nocase
        $s2 = "payment" nocase
        $s3 = "bitcoin" nocase
    condition:
        2 of them
}
'@
Invoke-FalconMalQuery -YaraRule $YaraRule -FilterMeta sha256,type,family -FilterFiletype pe32,pe64

# Exact search for ASCII string
Invoke-FalconMalQuery -Type ascii -Value 'MZ' -FilterFiletype pe32,pe64 -Limit 100

# Fuzzy search for hex pattern
Invoke-FalconMalQuery -Type hex -Value '4D5A' -Fuzzy -FilterMeta sha256,md5,size

# Search with date and size filters
Invoke-FalconMalQuery -Type ascii -Value 'malicious_string' -MinDate '2024/01/01' -MaxDate '2024/12/31' -MinSize '1KB' -MaxSize '5MB'

Receive-FalconMalQuerySample

Download a sample or sample archive from Falcon MalQuery. Permissions: MalQuery: Read

Downloaded sample archives are password-protected with the password: infected

string

required

Destination path

string

required

SHA256 hash value or MalQuery sample archive identifier

switch

Overwrite an existing file when present

Example

# Download a single sample by SHA256
Receive-FalconMalQuerySample -Id 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' -Path './sample.bin'

# Download a sample archive
Receive-FalconMalQuerySample -Id 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' -Path './samples.zip' -Force

Search-FalconMalQueryHash

Perform a simple Falcon MalQuery YARA Hunt for a SHA256 hash. Permissions: MalQuery: Write

This cmdlet performs a YARA Hunt for the given hash, then checks every 5 seconds—for up to 60 seconds—for a result.

string

required

SHA256 hash value

Example

# Quick search for a specific hash
Search-FalconMalQueryHash -Sha256 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'

MalQuery Hunting Workflow

Check Quota

Use Get-FalconMalQueryQuota to verify available search and download quota.

Initiate Search

Use Invoke-FalconMalQuery to start a YARA hunt, exact search, or fuzzy search. Save the request ID returned.

Poll for Results

Use Get-FalconMalQuery with the request ID to check search status. Repeat until status is complete.

Analyze Metadata

Use Get-FalconMalQuerySample with SHA256 hashes from results to retrieve detailed file metadata.

Download Samples

Use Group-FalconMalQuerySample to schedule samples, then Receive-FalconMalQuerySample to download them.

YARA Hunt Examples

# Hunt for PE files with suspicious characteristics
$YaraRule = @'
rule SuspiciousPE {
    meta:
        description = "Detects PE files with suspicious characteristics"
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        filesize < 50KB
}
'@

$Hunt = Invoke-FalconMalQuery -YaraRule $YaraRule -FilterFiletype pe32,pe64 -FilterMeta sha256,size,family

# Wait and check results
Start-Sleep -Seconds 10
$Results = Get-FalconMalQuery -Id $Hunt.reqid

# Hunt for potential credential harvesting malware
$YaraRule = @'
rule CredentialHarvester {
    strings:
        $s1 = "password" nocase
        $s2 = "credential" nocase
        $s3 = "username" nocase
        $s4 = "login" nocase
    condition:
        3 of them
}
'@

Invoke-FalconMalQuery -YaraRule $YaraRule -FilterFiletype pe32,pe64 -MinDate '2024/01/01'

# Hunt for files with C2 communication patterns
$YaraRule = @'
import "pe"

rule C2Communication {
    strings:
        $http = "http://" nocase
        $post = "POST" nocase
        $get = "GET" nocase
        $ua = "User-Agent:" nocase
    condition:
        pe.is_pe and
        all of them
}
'@

Invoke-FalconMalQuery -YaraRule $YaraRule -FilterFiletype pe32,pe64 -FilterMeta sha256,family,label

Exact vs Fuzzy Search

Exact Search

Use when: You need precise matches with no false positivesCharacteristics:

Slower execution
Higher accuracy
Consumes more quota
Best for known indicators

Fuzzy Search

Use when: You need quick results for broad huntingCharacteristics:

Faster execution
Potential false positives
Consumes less quota
Best for exploratory hunting

Tips and Best Practices

MalQuery searches consume quota. Always check your quota with Get-FalconMalQueryQuota before starting large hunts.

Use FilterMeta to limit returned metadata fields and reduce result size. Only request fields you need for analysis.

For hash-based searches, use Search-FalconMalQueryHash which automatically handles polling for results.

Falcon Intelligence

Access threat intelligence indicators

Sandbox Analysis

Submit samples for dynamic analysis

Sample Uploads

Upload samples to CrowdStrike

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Cmdlets

Get-FalconMalQuery

Get-FalconMalQueryQuota

Get-FalconMalQuerySample

Group-FalconMalQuerySample

Invoke-FalconMalQuery

Receive-FalconMalQuerySample

Search-FalconMalQueryHash

MalQuery Hunting Workflow

YARA Hunt Examples

Exact vs Fuzzy Search

Exact Search

Fuzzy Search

Tips and Best Practices

Falcon Intelligence

Sandbox Analysis

Sample Uploads

​Cmdlets

​Get-FalconMalQuery

​Get-FalconMalQueryQuota

​Get-FalconMalQuerySample

​Group-FalconMalQuerySample

​Invoke-FalconMalQuery

​Receive-FalconMalQuerySample

​Search-FalconMalQueryHash

​MalQuery Hunting Workflow

​YARA Hunt Examples

​Exact vs Fuzzy Search

Exact Search

Fuzzy Search

​Tips and Best Practices

​Related Resources

Falcon Intelligence

Sandbox Analysis

Sample Uploads

Cmdlets

Get-FalconMalQuery

Get-FalconMalQueryQuota

Get-FalconMalQuerySample

Group-FalconMalQuerySample

Invoke-FalconMalQuery

Receive-FalconMalQuerySample

Search-FalconMalQueryHash

MalQuery Hunting Workflow

YARA Hunt Examples

Exact vs Fuzzy Search

Tips and Best Practices

Related Resources