CrowdStrike Malquery

This Integration is part of the CrowdStrike Malquery Pack.#

Use the MalQuery Integration to query the contents of clean and malicious binary files, which forms part of Falcon's search engine. This integration was integrated and tested with version 1.0 of CrowdStrikeMalquery

Configure CrowdStrikeMalquery in Cortex#

Parameter	Description	Required
base_url	Server URL (e.g. https://example.net\)	True
client_id	Client ID	True
client_secret	Client Secret	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands#

You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

cs-malquery-exact-search#

Searches Falcon MalQuery for a combination of hex patterns and strings to identify malware samples based upon file content, which returns a request ID. Use the request ID in the cs-malquery-get-request command to retrieve results. You can filter results based on criteria such as file type, file size and first seen date.

Base Command#

cs-malquery-exact-search

Input#

Argument Name	Description	Required
hex	The hex pattern to search. For example, deadbeef0102 (for bytes de, ad, be, ef, 01, 02).	Optional
ascii	The ASCII pattern to search. For example, CrowdStrike.	Optional
wide	The wide string pattern to search. For example, CrowdStrike.	Optional
limit	The maximum number of results to be returned. Default is 100.	Optional
max_size	The maximum file size. The value can be specified either in bytes or in multiples of KB/MB/GB. For example, 128000, 1.3 KB, 8mb.	Optional
min_size	The minimum file size. The value can be specified either in bytes or in multiples of KB/MB/GB. For example, 128000, 1.3 KB, 8mb.	Optional
max_date	Limits results to files first seen before this date. The format is YYYY/MM/DD. For example, 2018/01/31.	Optional
min_date	Limits results to files first seen after this date. The format is YYYY/MM/DD. For example, 2018/01/31.	Optional
filter_filetypes	Limits results to certain file types such as EMAIL, PCAP, PDF, PE32. Comma separated values. For a full list of file types, see the MalQuery API documentation.	Optional
filter_meta	Specifies a subset of metadata fields to return in the results. Possible values - sha256, md5, type, size, first_seen, label, family. Comma separated values.	Optional

Context Output#

Path	Type	Description
Malquery.Request_ID	String	The request ID.

Command Example#

!cs-malquery-exact-search hex=8948208b480833ca33f989502489482889782c8bd7 filter_meta=sha256,type,size limit=5

Context Example#

{
    "Malquery": {
        "Request_ID": "08942ddd-373e-493d-54f9-f6e495174913"
    }
}

Human Readable Output#

Search Result#
Request_ID
08942ddd-373e-493d-54f9-f6e495174913

Request_ID
08942ddd-373e-493d-54f9-f6e495174913

cs-malquery-hunt#

Schedules a YARA rule-based search for execution, which returns a request ID. Use the request ID in the cs-malquery-get-request command to retrieve results. You can filter based on criteria such as file type, file size and first seen date.

Base Command#

cs-malquery-hunt

Input#

Argument Name	Description	Required
yara_rule	The YARA rule to search.	Optional
yar_file_entry_id	A YAR file entry ID that contains the YARA rule to search. Only one Yara rule per request.	Optional
limit	The maximum number of results to be returned.	Optional
max_size	The maximum file size. The value can be specified either in bytes or in multiples of KB/MB/GB. For example, 128000, 1.3 KB, 8mb.	Optional
min_size	The minimum file size. For example, 128000, 1.3 KB, 8mb.	Optional
max_date	Limits results to files first seen before this date. The format is YYYY/MM/DD. For example, 2018/01/31.	Optional
min_date	Limits results to files first seen after this date. The format is YYYY/MM/DD. For example, 2018/01/31.	Optional
filter_filetypes	Limits results to files of certain types such as EMAIL, PCAP, PDF, PE32. Comma separated values. For a full list of types, see the MalQuery API documentation.	Optional
filter_meta	Specifies a subset of metadata fields to return in the results. Possible values - sha256, md5, type, size, first_seen, label, family. Comma separated values.	Optional

Context Output#

Path	Type	Description
Malquery.Request_ID	String	The request ID.

Command Example#

!cs-malquery-hunt file_type=PE32 filter_meta=sha256,type,size limit=5 yara_rule="rule CrowdStrike_16142_01 : wiper { strings: $ = { 41 61 43 63 64 44 65 46 66 47 68 69 4B 4C 6C 4D 6D 6E 4E 6F 4F 70 50 72 52 73 53 54 74 55 75 56 76 77 57 78 79 5A 7A 33 32 2E 5C 45 62 67 6A 48 49 20 5F 59 51 42 3A 22 2F 40 } condition: all of them and filesize < 800KB }"

Context Example#

{
    "Malquery": {
        "Request_ID": "503efffd-2d44-4566-7794-8de45568cbbf"
    }
}

Human Readable Output#

Search Result#
Request_ID
503efffd-2d44-4566-7794-8de45568cbbf

Request_ID
503efffd-2d44-4566-7794-8de45568cbbf

cs-malquery-fuzzy-search#

Searches Falcon MalQuery quickly. Uses partial matching, but with more potential for false positives. Search for a combination of hex patterns and strings to identify samples based upon file content.

Base Command#

cs-malquery-fuzzy-search

Input#

Argument Name	Description	Required
hex	The hex pattern to search. For example, deadbeef0102 (for bytes de, ad, be, ef, 01, 02).	Optional
ascii	The ASCII pattern to search. For example, CrowdStrike.	Optional
wide	The wide string pattern to search. For example, CrowdStrike.	Optional
limit	The maximum number of results to be returned. Default is 100.	Optional
filter_meta	Specifies a subset of metadata fields to return in the results. Possible values - sha256, md5, type, size, first_seen, label, family. Comma separated values.	Optional

Context Output#

Path	Type	Description
Malquery.File.family	String	The malware family of the file. For example, StoneDrill.
Malquery.File.filesize	String	The size of the file.
Malquery.File.filetype	String	The type of the file.
Malquery.File.first_seen	String	The date when the file was first seen.
Malquery.File.label	String	The label of the file. For example, Malware.
Malquery.File.md5	String	The MD5 of the file.
Malquery.File.sha1	String	The SHA1 of the file.
Malquery.File.sha256	String	The SHA256 of the file.

Command Example#

!cs-malquery-fuzzy-search hex=8948208b480833ca33f989502489482889782c8bd7 filter_meta=sha256,type,size limit=5

Context Example#

{
    "Malquery": {
        "File": [
            {
                "filesize": 310552,
                "filetype": "PE32",
                "sha256": "e51f0a8884eb08fc43da0501ebd3776831e2fd4b0a8dd12e69866a8febe41495"
            },
            {
                "filesize": 1672180,
                "filetype": "PE32",
                "sha256": "bc74f8fc37b902536b52c1157b74724edc96a586b0e3e38717dd845981443a5b"
            },
            {
                "filesize": 1672188,
                "filetype": "PE32",
                "sha256": "72b021085f62e5dc1335f878a2751bce68d95918c84215ec8dfebf491009ea09"
            },
            {
                "filesize": 279624,
                "filetype": "PE32",
                "sha256": "5e2e1735e10684b36d30b3a3362e66cd30fb493afac8e711d92bde8372b9b6d0"
            },
            {
                "filesize": 19055104,
                "filetype": "PE32",
                "sha256": "d5023cd464d7578506770338e0fc43bd64887dbf234785b4d8f8547e57efa33d"
            }
        ]
    }
}

Human Readable Output#

Fuzzy Search Result#
filesize filetype sha256
310552 PE32 e51f0a8884eb08fc43da0501ebd3776831e2fd4b0a8dd12e69866a8febe41495
1672180 PE32 bc74f8fc37b902536b52c1157b74724edc96a586b0e3e38717dd845981443a5b
1672188 PE32 72b021085f62e5dc1335f878a2751bce68d95918c84215ec8dfebf491009ea09
279624 PE32 5e2e1735e10684b36d30b3a3362e66cd30fb493afac8e711d92bde8372b9b6d0
19055104 PE32 d5023cd464d7578506770338e0fc43bd64887dbf234785b4d8f8547e57efa33d

filesize	filetype	sha256
310552	PE32	e51f0a8884eb08fc43da0501ebd3776831e2fd4b0a8dd12e69866a8febe41495
1672180	PE32	bc74f8fc37b902536b52c1157b74724edc96a586b0e3e38717dd845981443a5b
1672188	PE32	72b021085f62e5dc1335f878a2751bce68d95918c84215ec8dfebf491009ea09
279624	PE32	5e2e1735e10684b36d30b3a3362e66cd30fb493afac8e711d92bde8372b9b6d0
19055104	PE32	d5023cd464d7578506770338e0fc43bd64887dbf234785b4d8f8547e57efa33d

cs-malquery-get-request#

Checks the status and results of an asynchronous request, such as hunt or exact-search. Supports a single request ID.

Base Command#

cs-malquery-get-request

Input#

Argument Name	Description	Required
request_id	The identifier of a MalQuery request.	Required

Context Output#

Path	Type	Description
Malquery.Request_ID	String	The request ID.
Malquery.Status	String	The status of the request.
Malquery.File.family	String	The malware family of the file. For example, StoneDrill.
Malquery.File.filesize	String	The size of the file.
Malquery.File.filetype	String	The type of the file. For example, PE32.
Malquery.File.first_seen	String	The date when the file was first seen.
Malquery.File.label	String	The label of the file. For example, malware.
Malquery.File.md5	String	The file MD5.
Malquery.File.sha1	String	The file SHA1.
Malquery.File.sha256	String	The file SHA256.

Command Example#

!cs-malquery-get-request request_id=096f6aa5-f245-4b09-790f-133bc89d4d26

Context Example#

{
    "Malquery": {
        "File": [
            {
                "filesize": 151552,
                "filetype": "PE32",
                "first_seen": "2020/06/09",
                "label": "unknown",
                "md5": "0b189ab69d40e782fe827c63e1cc6f06",
                "samples": [],
                "sha1": "85be23059c9abb3370586dc49dbd8f1ced05df8e",
                "sha256": "d207ccf1eabcc9453288896d963f1a1c558c427abfe9305d7328e3a6fb06f6ee"
            },
            {
                "family": "Stonedrill",
                "filesize": 245760,
                "filetype": "PE32",
                "first_seen": "2019/03/12",
                "label": "malware",
                "md5": "688bdedf1f9dd44d6db51a7f8499939c",
                "samples": [],
                "sha1": "2ca2622317bc840bf890d1e337d2c547be2cfebf",
                "sha256": "41a1d7b98d0ce3259270c9a8f26fe8899cca402cba69ef8e5c70449faea8b714"
            },
            {
                "family": "Stonedrill",
                "filesize": 317440,
                "filetype": "PE32",
                "first_seen": "2018/01/24",
                "label": "malware",
                "md5": "345ade2a73ee83e4f75447a26c4e78c9",
                "samples": [],
                "sha1": "6ae00484a878201e6150108ca1b234dd1f68930d",
                "sha256": "0f191518ab7f24643218bd3384ae4bd1f52ec80419730d87196605a2a69938d7"
            },
            {
                "family": "Cadlotcorg",
                "filesize": 128512,
                "filetype": "PE32",
                "first_seen": "2017/07/20",
                "label": "malware",
                "md5": "2b82ce15a632e3ce1485bfc87e586ee5",
                "samples": [],
                "sha1": "df07d50296914de0ca3116d4ca6d3845d55c7540",
                "sha256": "3fb85b787fa005e591cd2cd7e1e83c79d103b1c26f5da31fdf788764ae0b8bb0"
            },
            {
                "family": "Cadlotcorg",
                "filesize": 130560,
                "filetype": "PE32",
                "first_seen": "2016/12/09",
                "label": "malware",
                "md5": "697c515a46484be4f9597cb4f39b2959",
                "samples": [],
                "sha1": "b9fc1ac4a7ccee467402f190391974a181391da3",
                "sha256": "bf79622491dc5d572b4cfb7feced055120138df94ffd2b48ca629bb0a77514cc"
            }
        ],
        "Request_ID": "096f6aa5-f245-4b09-790f-133bc89d4d26",
        "Status": "done"
    }
}

Human Readable Output#

Search Result for request: 096f6aa5-f245-4b09-790f-133bc89d4d26#
filesize filetype first_seen label md5 sha1 sha256
151552 PE32 2020/06/09 unknown 0b189ab69d40e782fe827c63e1cc6f06 85be23059c9abb3370586dc49dbd8f1ced05df8e d207ccf1eabcc9453288896d963f1a1c558c427abfe9305d7328e3a6fb06f6ee
245760 PE32 2019/03/12 malware 688bdedf1f9dd44d6db51a7f8499939c 2ca2622317bc840bf890d1e337d2c547be2cfebf 41a1d7b98d0ce3259270c9a8f26fe8899cca402cba69ef8e5c70449faea8b714
317440 PE32 2018/01/24 malware 345ade2a73ee83e4f75447a26c4e78c9 6ae00484a878201e6150108ca1b234dd1f68930d 0f191518ab7f24643218bd3384ae4bd1f52ec80419730d87196605a2a69938d7
128512 PE32 2017/07/20 malware 2b82ce15a632e3ce1485bfc87e586ee5 df07d50296914de0ca3116d4ca6d3845d55c7540 3fb85b787fa005e591cd2cd7e1e83c79d103b1c26f5da31fdf788764ae0b8bb0
130560 PE32 2016/12/09 malware 697c515a46484be4f9597cb4f39b2959 b9fc1ac4a7ccee467402f190391974a181391da3 bf79622491dc5d572b4cfb7feced055120138df94ffd2b48ca629bb0a77514cc

filesize	filetype	first_seen	label	md5	sha1	sha256
151552	PE32	2020/06/09	unknown	0b189ab69d40e782fe827c63e1cc6f06	85be23059c9abb3370586dc49dbd8f1ced05df8e	d207ccf1eabcc9453288896d963f1a1c558c427abfe9305d7328e3a6fb06f6ee
245760	PE32	2019/03/12	malware	688bdedf1f9dd44d6db51a7f8499939c	2ca2622317bc840bf890d1e337d2c547be2cfebf	41a1d7b98d0ce3259270c9a8f26fe8899cca402cba69ef8e5c70449faea8b714
317440	PE32	2018/01/24	malware	345ade2a73ee83e4f75447a26c4e78c9	6ae00484a878201e6150108ca1b234dd1f68930d	0f191518ab7f24643218bd3384ae4bd1f52ec80419730d87196605a2a69938d7
128512	PE32	2017/07/20	malware	2b82ce15a632e3ce1485bfc87e586ee5	df07d50296914de0ca3116d4ca6d3845d55c7540	3fb85b787fa005e591cd2cd7e1e83c79d103b1c26f5da31fdf788764ae0b8bb0
130560	PE32	2016/12/09	malware	697c515a46484be4f9597cb4f39b2959	b9fc1ac4a7ccee467402f190391974a181391da3	bf79622491dc5d572b4cfb7feced055120138df94ffd2b48ca629bb0a77514cc

cs-malquery-get-ratelimit#

Returns information about search and download quotas in your environment.

Base Command#

cs-malquery-get-ratelimit

Context Output#

Path	Type	Description
Malquery.Quota.hunt_count	number	How many hunts were executed in the last month.
Malquery.Quota.download_count	number	How many downloads were executed in the last month.
Malquery.Quota.monitor_count	number	How many monitors were created in the last month.
Malquery.Quota.hunt_limit	number	Total hunt limit per month.
Malquery.Quota.download_limit	number	The total download limit per month.
Malquery.Quota.monitor_limit	number	The total monitor limit per month.
Malquery.Quota.refresh_time	string	The time when the limits are refreshed. ISO 8601 format.
Malquery.Quota.days_left	number	The days left until the limits are refreshed.
Malquery.Quota.hunt_counts.userid	String	The download counts per user.
Malquery.Quota.hunt_counts.counter	number	The download counts per user.

Command Example#

!cs-malquery-get-ratelimit

Context Example#

{
    "Malquery": {
        "Quota": {
            "days_left": 3,
            "download_count": 28,
            "download_counts": [
                {
                    "counter": 28,
                    "userid": ""
                }
            ],
            "download_limit": 50,
            "hunt_count": 83,
            "hunt_counts": [
                {
                    "counter": 83,
                    "userid": ""
                }
            ],
            "hunt_limit": 100,
            "monitor_count": 0,
            "monitor_limit": 10,
            "refresh_time": "2020-08-01T00:00:00Z"
        }
    }
}

Human Readable Output#

Quota Data#
hunt_count download_count monitor_count hunt_limit download_limit monitor_limit refresh_time days_left
83 28 0 100 50 10 2020-08-01T00:00:00Z 3

hunt_count	download_count	monitor_count	hunt_limit	download_limit	monitor_limit	refresh_time	days_left
83	28	0	100	50	10	2020-08-01T00:00:00Z	3

cs-malquery-samples-multidownload#

Schedule samples for download, which returns a request ID. Use the request ID in the cs-malquery-get-request, to check the status of the operation. When the request status is “done”, use the cs-malquery-sample-fetch to download the results as a password-protected archive. The password to extract results from the archive: infected'

Base Command#

cs-malquery-samples-multidownload

Input#

Argument Name	Description	Required
samples	Sample sha256 IDs. Comma separated values.	Required

Context Output#

Path	Type	Description
Malquery.Request_ID	String	The request ID.
Malquery.Status	String	The request status.

Command Example#

!cs-malquery-samples-multidownload samples=742db9f3ae1b7322dfe8ab81476cd3146f9c0ce086fc4cd38a1072fb6cae8662,accc6794951290467e01b7676e8b4ba177076d54f836589ea7d3298cdf6fc995

Context Example#

{
    "Malquery": {
        "Request_ID": "e2e1aecb-6e34-44f7-5d42-932880276c5e"
    }
}

Human Readable Output#

Samples Multidownload Request#
Request_ID
e2e1aecb-6e34-44f7-5d42-932880276c5e

Request_ID
e2e1aecb-6e34-44f7-5d42-932880276c5e

cs-malquery-file-download#

Download a file indexed by MalQuery. Specify the file using its SHA256. Only one file is supported.

Base Command#

cs-malquery-file-download

Input#

Argument Name	Description	Required
file_id	The SHA256 file.	Required

Context Output#

Path	Type	Description
File.SHA256	String	The SHA256 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA512	String	The SHA512 hash of the file.
File.Name	String	The name of the file.
File.EntryID	String	The Entry ID.
File.Info	String	Information about the file.
File.Type	String	The type of the file.
File.MD5	String	MD5 hash of the file.

Command Example#

!cs-malquery-file-download file_id=d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766

Context Example#

{
    "File": {
        "EntryID": "3993@904ba2df-a395-4270-8a6b-e9b8d614911e",
        "Info": "application/x-dosexec",
        "MD5": "c6a6a731f341ced1d93b61bc7628721d",
        "Name": "d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766",
        "SHA1": "8953cdddbe825e8378c590084dca1e3d76ced233",
        "SHA256": "d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766",
        "SHA512": "09c164142da9b4d8decb3cbbfa2916326aeab50d79bffa6090816f2cdb89838ac79fc7451c5997c06a9186c1bc0661283fc86cd5838d40e4b07b8a5d6bd8bb13",
        "SSDeep": "24576:qripAq8fCAmHY/Ph9Kv18re7NHHReC3Mm:quptkhOveSBImMm",
        "Size": 1076152,
        "Type": "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
    }
}

cs-malquery-sample-fetch#

Fetches a zip archive file using the password, "infected" containing the samples. Use this after the cs-malquery-samples-multidownload request has finished processing.

Base Command#

cs-malquery-sample-fetch

Input#

Argument Name	Description	Required
request_id	Identifier of a MalQuery request.	Required

Context Output#

Path	Type	Description
File.SHA256	String	THe SHA256 hash of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA512	String	The SHA512 hash of the file.
File.Name	String	The name of the file.
File.EntryID	String	The entry ID.
File.Info	String	Information about the file.
File.Type	String	The type of the file.
File.MD5	String	The MD5 hash of the file.

Command Example#

!cs-malquery-sample-fetch request_id=93b55373-3b69-43cb-6ea1-2870a44e1c1e

Context Example#

{
    "File": {
        "EntryID": "3517@904ba2df-a395-4270-8a6b-e9b8d614911e",
        "Info": "application/zip",
        "MD5": "a19a427b08c84f27a5a2b9f59fd8f752",
        "Name": "93b55373-3b69-43cb-6ea1-2870a44e1c1e",
        "SHA1": "01583032c5b9df88266da1d0cc46d41678203f2d",
        "SHA256": "a959753414fcf8367054e195424d86feb75f3819272754178efc6ec0963f6bb0",
        "SHA512": "3cce7bbca53570da2925da32942c7f20f1f619b016395a663c0abdb1e54eed06ad0b7b60687286f04278196693b4e44255c2cf25ed953a1c512d58625775704b",
        "SSDeep": "49152:Pm7wDIVHR7jadrFtkGU5fW/Lv4yZ4mXoGODTmtvL7ERwjU3IDcJA2I:O7wDAHgfkpfiv4PmXoGO3mhLIRwL7",
        "Size": 3059253,
        "Type": "Zip archive data, at least v1.0 to extract"
    }
}

Human Readable Output#

file#

Retrieves indexed files metadata by their hash.

Base Command#

file

Input#

Argument Name	Description	Required
file	The SHA256 of the files. Comma separated values.	Required

Context Output#

Path	Type	Description
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Indicator	String	The indicator that was tested.
File.Vendor	String	The vendor used to calculate the score.
Malquery.File.family	String	The malware family of the file. For example, StoneDrill.
Malquery.File.filesize	String	The size of the file.
Malquery.File.filetype	String	The type of the file.
Malquery.File.first_seen	String	The date when the file was first seen.
Malquery.File.label	String	The label of the file.
Malquery.File.md5	String	The MD5 hash of the file.
Malquery.File.sha1	String	The SHA1 hash of the file.
Malquery.File.sha256	String	The SHA256 hash of the file.

Command Example#

!file file=d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766

Context Example#

{
    "DBotScore": {
        "Indicator": "d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766",
        "Score": 0,
        "Type": "file",
        "Vendor": "CrowdStrike Malquery"
    },
    "File": {
        "SHA256": "d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766"
    },
    "Malquery": {
        "File": {
            "filesize": 1076152,
            "filetype": "PE32",
            "first_seen": "2014/01/27",
            "label": "unknown",
            "md5": "c6a6a731f341ced1d93b61bc7628721d",
            "sha1": "8953cdddbe825e8378c590084dca1e3d76ced233",
            "sha256": "d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766"
        }
    }
}

Human Readable Output#

CrowdStrike Malquery File reputation#
filesize filetype first_seen label md5 sha1 sha256
1076152 PE32 2014/01/27 unknown c6a6a731f341ced1d93b61bc7628721d 8953cdddbe825e8378c590084dca1e3d76ced233 d77cf874521ee7d4bb7f54bd8cef3d60ec24d267cf2d502f819880f0819f5766