Sample Files

Get-FalconSample [-Id] <string[]>

Send-FalconSample [-Path] <string> [[-IsConfidential] <boolean>] [[-Comment] <string>] [[-Name] <string>]

Receive-FalconSample [-Path] <string> [-Id] <string> [[-PasswordProtected] <boolean>] [-Force]

Remove-FalconSample [-Id] <string>

# Upload sample file
$result = Send-FalconSample -Path 'C:\Samples\suspicious.exe' -Comment 'Potential malware from endpoint'

# Capture SHA256 for analysis
$sha256 = $result.sha256

# Submit to Falcon Sandbox for analysis
Submit-FalconSandbox -Sha256 $sha256

# List of SHA256 hashes
$hashes = @(
  'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
  'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2'
)

# Download each sample with password protection
foreach ($hash in $hashes) {
  $filename = "sample_$hash.zip"
  Receive-FalconSample -Path "C:\Downloads\$filename" -Id $hash -PasswordProtected $true
}

# Upload all executables from a directory
Get-ChildItem 'C:\Quarantine\*.exe' | ForEach-Object {
  $result = Send-FalconSample -Path $_.FullName -Comment "Quarantine upload - $($_.Name)"
  [PSCustomObject]@{
    FileName = $_.Name
    SHA256 = $result.sha256
    UploadTime = Get-Date
  }
} | Export-Csv 'C:\Logs\uploaded_samples.csv' -NoTypeInformation