Windows Crowdstrike RTR Script Execution
Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command. This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
Splunk (SPL)
