[CROWDSTRIKE] Possible Persistence Attempt Killed - Suspicious Registry Change Indicating Malicious Persistence Mechanism

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Persistence Attempt Killed - Suspicious Registry Change Indicating Malicious Persistence Mechanism"; program:CrowdStrike; content:"A process made a suspicious change to the registry that might indicate a malicious persistence mechanism"; content:"killed"; nocase; content:"tactic=Persistence"; normalize; classtype:suspicious-traffic; sid:5017692; rev:1;)