[CROWDSTRIKE] Possible Defense Evasion Blocked - Process Attempted To Remove CsDeviceControl From Registry

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Defense Evasion Blocked - Process Attempted To Remove CsDeviceControl From Registry"; program:CrowdStrike; content:"A process attempted to remove CsDeviceControl from the registry"; content:"blocked"; nocase; content:"cat=Defense Evasion"; normalize; classtype:suspicious-traffic; sid:5017546; rev:1;)