[CROWDSTRIKE] Possible Command And Control Blocked - Process Attempted To Establish Unusual Connection Over Commonly Used Port Possibly To Command And Control Server

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Command And Control Blocked - Process Attempted To Establish Unusual Connection Over Commonly Used Port Possibly To Command And Control Server"; program:CrowdStrike; content:"A process attempted to establish an unusual connection over a commonly used port, possibly to a command and control server"; content:"blocked"; nocase; content:"tactic=Command and Control"; normalize; classtype:suspicious-traffic; sid:5017465; rev:1;)