[CROWDSTRIKE] Possible Defense Evasion Blocked - Process Attempted To Modify System AMSI Provider Configuration

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Defense Evasion Blocked - Process Attempted To Modify System AMSI Provider Configuration"; program:CrowdStrike; content:"A process attempted to modify the system AMSI provider configuration via the configuration"; content:"blocked"; nocase; content:"cat=Defense Evasion"; normalize; classtype:suspicious-traffic; sid:5017498; rev:1;)