CrowdStrike – Falcon Sandbox

CrowdStrike Falcon Sandbox is an automated malware analysis product offered within the Falcon Threat Intelligence and Hunting portfolio, built on a hybrid analysis engine that merges runtime behavior, static analysis and memory dump inspection to surface execution paths even in evasive samples. Monitoring runs in the kernel without an in-guest agent, and the vendor says each release is tested against sandbox-detection techniques. The product handles more than 40 file types across executables, documents, scripts, images and archives, has been documented as supporting Windows, macOS, Linux and Android (static analysis only), and produces reports with threat scores, behavior breakdowns, forensic artifacts, MITRE ATT&CK mapping and extracted IOCs. A malware search capability compares each sample against a large corpus of previously seen files to link it to campaigns, malware families or threat actors, and suspicious files identified by the Falcon sensor can be submitted automatically for analysis. An extensive API and prebuilt integrations let teams orchestrate analysis from existing security tools. The same technology powers the free Hybrid Analysis community service, which the vendor presents as an on-ramp to a full license. Falcon Sandbox is a module of the Falcon platform, so teams already running Falcon can fold it into existing workflows.