[CROWDSTRIKE] Suspicious Impact: Data encrypted for impact activity observed - Critical

alert any any any -> any any (msg:"[CROWDSTRIKE] Suspicious Impact: Data encrypted for impact activity observed - Critical"; program:CrowdStrike; content:"technique=Data Encrypted for Impact"; content:"cat=Impact"; content:!"Ransomware file operation activity has been observed occurring over a remote SMB connection"; normalize; classtype:suspicious-traffic; priority:1; sid:5017616; rev:1;)