[CROWDSTRIKE] Possible Initial Access - Web-based activity detected as anomalous by ML model

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Initial Access - Web-based activity detected as anomalous by ML model"; program:CrowdStrike; content:"A web-based activity was detected as anomalous by ML model"; content:"tactic=Initial Access"; normalize; classtype:suspicious-traffic; sid:5017626; rev:1;)