[CROWDSTRIKE] Possible Defense Evasion Detected - Process Attempted To Remove CsDeviceControl From Registry

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Defense Evasion Detected - Process Attempted To Remove CsDeviceControl From Registry"; program:CrowdStrike; content:"A process attempted to remove CsDeviceControl from the registry"; content:"standard detection"; nocase; content:"cat=Defense Evasion"; normalize; classtype:suspicious-traffic; sid:5017548; rev:1;)