[CROWDSTRIKE] An Office file with a macro written to the file system meets the File Analysis ML algorithm's medium-confidence threshold for malware.

alert any $HOME_NET any -> $HOME_NET any (msg:"[CROWDSTRIKE] An Office file with a macro written to the file system meets the File Analysis ML algorithm's medium-confidence threshold for malware."; program:CrowdStrike; content:"msg=An Office file with a macro written to the file system meets the File Analysis ML algorithm's medium-confidence threshold for malware."; parse_src_ip:1; normalize; reference:url,https://www.reddit.com/r/crowdstrike/comments/rbbzwi/pattern_disposition_values_in_detect_api/; classtype:trojan-activity; sid:5016625; rev:1; metadata:created_at 2025_06_25, updated_at 2025_06_25;)