feat: add new rule related to "Amazon SSM Agent" potential abuse (#4369)

rules/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml

@@ -0,0 +1,29 @@
+title: Potential Amazon SSM Agent Hijacking
+id: d20ee2f4-822c-4827-9e15-41500b1fff10
+status: experimental
+description: Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research reoport.
+references:
+    - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
+    - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
+    - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
+author: Muhammad Faisal
+date: 2023/08/02
+tags:
+    - attack.command_and_control
+    - attack.persistence
+    - attack.t1219
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\amazon-ssm-agent.exe'
+        CommandLine|contains|all:
+            - '-register '
+            - '-code '
+            - '-id '
+            - '-region '
+    condition: selection
+falsepositives:
+    - Legitimate activity of system administrators
+level: medium