[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Quarantined Files In A Detection Summary Event

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Quarantined Files In A Detection Summary Event"; program:CrowdStrike; content:"Quarantined Files In A Detection Summary Event"; content:!"msg="; content:"standard detection"; nocase; content:"cat=Defense Evasion"; normalize; classtype:suspicious-traffic; sid:5017563; rev:1;)