A CrowdStrike Falcon Sandbox score of 11 out of 100 indicates that the analyzed file or program has a very low probability of being malicious. A lower score is better, as the system assesses the threat level and assigns a score based on how suspicious the activity appears.  

​

How to interpret CrowdStrike sandbox scores 

​

∙High scores (e.g., 70-100):

 

Indicate a high probability that the file is malicious, exhibiting numerous suspicious or malicious behaviors. This should be treated as a significant threat and blocked or quarantined immediately. 

​

∙Low scores (e.g., 1-20):

 

Suggest that the file is likely benign and does not exhibit malicious behavior. A score of 11 is well within this low-risk range. 

​

∙Medium scores (e.g., 40-60):

 

Can be tricky to interpret. Some legitimate software may perform actions that appear suspicious to a sandbox, leading to a moderate score. Other times, it may indicate a potentially unwanted application (PUA) or a file with some low-level risk.  

​

What a low score means 

​

In the context of a sandbox analysis, a low score of 11 means: ∙The file did not exhibit known malicious behaviors like downloading malware, 

attempting to exploit vulnerabilities, or performing data exfiltration. ∙The analysis did not reveal a strong match to a known malware family or a clear malicious intent. 

∙While not a guarantee of perfect safety, it provides strong evidence that the file is likely not a threat. It's important to remember that sandbox analysis is an automated tool and should be used as part of a broader security strategy.