[CROWDSTRIKE] User Login From Unusual Machine

alert any $HOME_NET any -> $HOME_NET any (msg:"[CROWDSTRIKE] User Login From Unusual Machine"; program: CrowdStrike; content: "A user performed a network login from an unusual machine"; parse_src_ip: 1; normalize; threshold: type suppress, track by_src, count 5, seconds 60; classtype: suspicious-login; sid: 5017171; rev: 1; metadata: created_at 2025_08_01;)