Starting at Fal.Con 2026, we're releasing a completely reengineered Hybrid Analysis that employs the latest technology and advanced new capabilities: a new analysis engine, a new search and hunting layer, and an API designed to be scripted against, not just clicked through. Below are key changes that are worth your attention.
At a Glance
- QuickScan Pro is now the default engine, returning ML-based verdicts with adversary attribution and malware configuration extraction.
- A single sample overview replaces separate tabs for static, dynamic, multi-AV, and threat intel results.
- A real query language (HackerOne Analytics Query Language – HAQL) with autocomplete replaces the old search forms; MalQuery is now part of the same search bar.
- YARA hunting and retro hunting: match rules against new submissions, or run them against a defined historical corpus.
- Open-source integration tools: an MCP server and a Python CLI give scripts and agents the same access as the UI.
- Regular release cadence going forward, replacing infrequent large updates.
QuickScan Pro Leads; Falcon Sandbox and MetaDefender Remain
CrowdStrike's QuickScan Pro is now the primary processing engine, replacing multi-AV scanning as the default path. It combines ML-based static analysis with threat intelligence context, so a verdict arrives with adversary attribution and, where applicable, extracted malware configuration — C2 infrastructure, campaign identifiers — rather than a binary clean/dirty result.
Results arrive in stages, with file properties and an initial verdict appearing within seconds. Intelligence correlation follows. The new Hybrid Analysis design means that full sandbox detonation is no longer required to generate a usable verdict.
MetaDefender multi-AV scanning and Falcon Sandbox detonation remain available for cases requiring vendor breadth or full behavioral analysis.
New Sample Overview Page With Unified View
The sample overview page now merges static artifacts, dynamic behavior, multi-engine verdicts, and threat intel context into a single view, with the verdict displayed alongside supporting evidence rather than in a separate tab.
For samples with multiple sandbox runs, the overview distinguishes behavior consistent across runs from behavior that is environment-specific or evasion-triggered.
Metadata extraction has also been extended. LNK files, for example, now surface extracted command-line arguments directly in the sample metadata:
Search and Pivoting
Search forms have been replaced with a single search bar offering field, operator, and value autocomplete, backed by a unified metadata index. MalQuery is now integrated into the same bar rather than run as a separate tool.
Full query syntax is documented at https://hybrid-analysis.com/docs. Quick filters remain available in the sidebar.
Forward and Retro Hunting
YARA rules can be uploaded and managed via UI or API, and are matched against every new submission going forward.
Retro hunting extends this to historical data: define a corpus with a search query — for example, PE files submitted last quarter with outbound network activity — and run a YARA rule against that subset only. This is the intended workflow for checking whether a newly disclosed campaign pattern already appears in earlier, unattributed submissions.
API-first, With Tooling to Match
Every UI feature is exposed as a REST endpoint. To reduce integration overhead, we're open-sourcing a set of tools on GitHub:
- MCP server: exposes submission, verdict retrieval, and natural-language-to-query translation to AI agent workflows.
- Python CLI: scripted submission and querying.
A separate set of Labs API endpoints, documented at https://hybrid-analysis.com/docs/api/labs, targets agent and LLM use cases specifically and will iterate faster than the stable API.
Release Cadence
We're moving to more frequent releases going forward, rather than occasional large updates.
This launch is a starting point. Test the new search, run a retro hunt against your own rules, and submit feedback — your use and input will directly shape near-term releases.
