d5c57463e1
* new rule 'First Occurrence of AWS Resource Starting SSM Session to EC2 Instance' * added investigation guide * changed file name to match tactic * changed reference * updated tags * updated investigation notes * changed new terms value; adjusted rule name