CrowdStrike Privilege Escalation Attempt by Non-Admin User

This analytic detects CrowdStrike alerts indicating privilege escalation attempts by non-admin users. These alerts signify unauthorized efforts by regular users to gain elevated permissions, which poses a significant security risk. Detecting and addressing these attempts promptly helps prevent potential breaches and ensures that user privileges remain properly managed, maintaining the integrity of the organization's security protocols. The rule specifically filters for alerts containing "Privilege escalation" in the incident type and excludes users identified as administrators or service accounts.