[CROWDSTRIKE] Possible Persistence Attempt Blocked - Suspicious Registry Change Indicating Malicious Persistence Mechanism

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Persistence Attempt Blocked - Suspicious Registry Change Indicating Malicious Persistence Mechanism"; program:CrowdStrike; content:"A process made a suspicious change to the registry that might indicate a malicious persistence mechanism"; content:"blocked"; nocase; content:"tactic=Persistence"; normalize; classtype:suspicious-traffic; sid:5017691; rev:1;)