Sagan critical stable other

[CROWDSTRIKE] Possible Privilege Escalation - A user received new privileges.

[CROWDSTRIKE] Possible Privilege Escalation - A user received new privileges.

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[CROWDSTRIKE] Possible Privilege Escalation - A user received new privileges."; program:CrowdStrike; content:"msg=A user received new privileges"; parse_src_ip:1; normalize; reference:url,https://www.reddit.com/r/crowdstrike/comments/rbbzwi/pattern_disposition_values_in_detect_api/; classtype:trojan-activity; sid:5016629; rev:1; metadata:created_at 2025_06_25, updated_at 2025_06_25;)

Field Validations

Loading…

Comments (0)

Loading comments...