[CROWDSTRIKE] Possible Privilege Escalation Detected - Process Escalated Privileges Possible Access Control Bypass

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Privilege Escalation Detected - Process Escalated Privileges Possible Access Control Bypass"; program:CrowdStrike; content:"A process has escalated privileges, this could be as a result of an adversary's attempt to bypass access controls or as part of legitimate system administration"; content:"tactic=Privilege Escalation"; normalize; classtype:suspicious-traffic; sid:5017714; rev:1;)