[CROWDSTRIKE] Possible Privilege Escalation Detected - User Executed Valid Accounts DCE/RPC Command Targeting DC For First Time

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Privilege Escalation Detected - User Executed Valid Accounts DCE/RPC Command Targeting DC For First Time"; program:CrowdStrike; content:"A user executed a valid accounts DCE/RPC command targeting a DC for the first time"; content:"tactic=Privilege Escalation"; normalize; classtype:suspicious-traffic; sid:5017717; rev:1;)