[CROWDSTRIKE] Privilege Escalation Tactic - An Authentication Protocol As Used In An Unusual Manner

alert any $HOME_NET any -> $HOME_NET any (msg:"[CROWDSTRIKE] Privilege Escalation Tactic - An Authentication Protocol As Used In An Unusual Manner"; program:CrowdStrike; content: "msg=An authentication protocol was used in an unusual manner"; content:"tactic=Privilege Escalation"; pcre:"/(?!targetAccountName=[a-zA-Z0-9]+\$)/"; parse_src_ip:1; normalize; reference:url,https://www.reddit.com/r/crowdstrike/comments/rbbzwi/pattern_disposition_values_in_detect_api/; classtype:trojan-activity; sid:5017070; rev:1; metadata:created_at 2025_07_29;)