dev-v0.2.0

Changes

• Lock versions for releases: 8.11,8.12,8.13,8.14,8.15,8.16 (#4267) @github-actions
• [New] First Time Seen User Auth via DeviceCode Protocol (#4153) @Samirbous
• [New] Remote Desktop File Opened from Suspicious Path (#4251) @Samirbous
• [Rule Tuning] Tuning Process Termination followed by Deletion (#4173) @terrancedejesus
• [New Rule] Potential Hex Payload Execution (#4241) @Aegrah
• [New Rule] Memory Swap Modification (#4239) @Aegrah
• [New Rule] Unusual Interactive Shell Launched from System User (#4238) @Aegrah
• [New Rule] Web Server Spawned via Python (#4236) @Aegrah
• [New Rule] Directory Creation in /bin directory (#4227) @Aegrah
• [New Rule] Hidden Directory Creation via Unusual Parent (#4226) @Aegrah
• [New Rule] Security File Access via Common Utilities (#4243) @Aegrah
• [New Rule] Potential Data Splitting Detected (#4235) @Aegrah
• [New Rule] Private Key Searching Activity (#4242) @Aegrah
• [New Rule] IPv4/IPv6 Forwarding Activity (#4240) @Aegrah
• [New Rule] Curl SOCKS Proxy Activity from Unusual Parent (#4237) @Aegrah
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 8 (#4233) @w0rk3r
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 7 (#4232) @w0rk3r
• [Tuning] Suspicious Lsass Process Access (#4188) @Samirbous
• Add investigation guide for Amazon Bedrock Rules (#4247) @shashank-elastic
• [New Rule] Adding Coverage for AWS Discovery API Calls via CLI from a Single Resource (#4246) @terrancedejesus
• [Rule Tuning] Tuning AWS STS Temporary Credentials via AssumeRole (#4228) @terrancedejesus
• [New Rule] Adding Coverage for AWS SSM Command Document Created by Rare User (#4229) @terrancedejesus
• [New Rule] Adding Coverage for AWS IAM Create User via Assumed Role on EC2 Instance (#4244) @terrancedejesus
• [New Rule] Adding Coverage for AWS SNS Email Subscription by Rare User (#4224) @terrancedejesus
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 9 (#4234) @w0rk3r
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 6 (#4231) @w0rk3r
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 5 (#4230) @w0rk3r
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 4 (#4225) @w0rk3r
• [New Rule] AWS STS AssumeRole with New MFA Device [Rule Tuning] AWS IAM Deactivation of MFA Device (#4210) @imays11
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 3 (#4222) @w0rk3r
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 2 (#4221) @w0rk3r

🚀 Features

• Account for CCS '::' index pattern (#4258) @shashank-elastic
• Update ATT&CK coverage URL(s) in docs/ATT&CK-coverage.md (#4265) @github-actions
• Prep for Release 8.17 (#4256) @shashank-elastic
• [FR] Reset package version and push tag via ci (#4260) @Mikaayenson
• [FR] Update the release versioning process and workflow (#4257) @Mikaayenson
• [FR] Update release-drafter.yml (#4252) @Mikaayenson
• [FR] Add Versioning Processes to DR (#4223) @Mikaayenson

🐛 Bug Fixes

• Fix extra new line in ATT&CK-coverage.md (#4263) @shashank-elastic
• [FR] Fetch history for versioning workflow (#4259) @Mikaayenson
• [Testing] Update release-drafter.yml (#4254) @Mikaayenson
• [FR] DRAFT Release Workflow on PR Merge (#4253) @Mikaayenson

🛠 Internal Changes

• Account for CCS '::' index pattern (#4258) @shashank-elastic
• [Rule Tuning] Add Investigation Fields to Specific AWS Rules (#4261) @terrancedejesus
• Fix extra new line in ATT&CK-coverage.md (#4263) @shashank-elastic
• Prep for Release 8.17 (#4256) @shashank-elastic
• [FR] DRAFT Release Workflow on PR Merge (#4253) @Mikaayenson
• [New Rule] Adding Coverage for AWS IAM Customer-Managed Policy Attached to Role by Rare User (#4245) @terrancedejesus
• [Rule Tuning] Add Investigation Guides to AWS Rules (#4249) @terrancedejesus
• [Rule Tuning] 3rd Party EDR - Add Crowdstrike FDR support - 1 (#4220) @w0rk3r

🔍 Hunting Updates

• [New Rule] Adding Coverage for AWS IAM Customer-Managed Policy Attached to Role by Rare User (#4245) @terrancedejesus