New FalconSubmission - CrowdStrike/psfalcon GitHub Wiki

New-FalconSubmission

SYNOPSIS

Submit a sample to the Falcon Intelligence Sandbox

DESCRIPTION

'Sha256' values are retrieved from files that are uploaded using 'Send-FalconSample'. Files must be uploaded before they can be provided to the Falcon Intelligence Sandbox.

Requires 'Sandbox (Falcon Intelligence): Write'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
EnvironmentId String Analysis environment android
macOS_10.15
ubuntu16_x64
ubuntu20_x64
win7_x64
win7_x86
win10_x64
win11_x64
AutoDetect Boolean Auto detect environment
Url String A webpage or file URL
ActionScript String Runtime script for sandbox analysis default
default_maxantievasion
default_randomfiles
default_randomtheme
default_openie
Browser String Browser to use with URL submission
Interactivity Boolean Whether sandbox detonation is interactive
CommandLine String Command line script passed to the submitted file at runtime
SystemDate String A custom date to use in the analysis environment
SystemTime String A custom time to use in the analysis environment
DocumentPassword String Auto-filled for Adobe or Office files that prompt for a password
NetworkSetting String Network settings to use in the analysis environment default
offline
simulated
tor
EnableTor Boolean Route traffic via TOR
UserTag String[] Tags to categorize the submission
SendEmail Boolean Send email notification
Aid String Agent identifier
SubmitName String Submission name X
Sha256 String Sha256 hash value X X

SYNTAX

New-FalconSubmission [[-EnvironmentId] <String>] [[-AutoDetect] <Boolean>] [[-Url] <String>] [[-ActionScript] <String>] [[-Browser] <String>] [[-Interactivity] <Boolean>] [[-CommandLine] <String>] [[-SystemDate] <String>] [[-SystemTime] <String>] [[-DocumentPassword] <String>] [[-NetworkSetting] <String>] [[-EnableTor] <Boolean>] [[-UserTag] <String[]>] [[-SendEmail] <Boolean>] [[-Aid] <String>] [[-SubmitName] <String>] [[-Sha256] <String>] [-WhatIf] [-Confirm] [<CommonParameters>]

REFERENCE

Endpoints

POST /falconx/entities/submissions/v1

falconpy

Submit

USAGE

Submit an uploaded sample for analysis in a sandbox environment

The file submitted to the Falcon Intelligence Sandbox must be previously uploaded through Send-FalconSample.

New-FalconSubmission -Sha256 <sha256> -EnvironmentId win7_x86 -SubmitName virus.exe

See Send-FalconSample.

2025-09-19: PSFalcon v2.2.9

⚠️ **GitHub.com Fallback** ⚠️