AWS SES Full Access Policy Attached to IAM Entity by Unusual User

  1[metadata]
  2creation_date = "2026/08/31"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/31"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first occurrence in 7 days of an AWS identity attaching the managed policy
 11AmazonSESFullAccess to an IAM user, role, or group. AmazonSESFullAccess grants unrestricted
 12permission to send email, manage identities and templates, manage suppression lists, and access
 13SES account-level settings. Granting this policy to an unexpected IAM entity, particularly a newly
 14created user or a role not previously associated with email operations, is a documented technique
 15used by threat actors to establish phishing infrastructure on compromised AWS accounts, enabling
 16them to send email on behalf of the victim organization's trusted sending domain. Using new terms
 17on the calling identity suppresses recurring attachments by known email automation while
 18surfacing identities performing this action for the first time.
 19"""
 20false_positives = [
 21    """
 22    Legitimate email service automation may attach AmazonSESFullAccess to a service account.
 23    Validate the target IAM entity against known email automation roles and CI/CD pipeline identities.
 24    Because this is a new terms rule keyed on the calling identity, recurring attachments by the
 25    same automation will not re-alert within the 7-day history window; first-time attachments by
 26    administrators performing legitimate setup may still trigger and should be validated against
 27    change management records.
 28    """,
 29]
 30from = "now-6m"
 31index = ["logs-aws.cloudtrail-*"]
 32language = "kuery"
 33license = "Elastic License v2"
 34name = "AWS SES Full Access Policy Attached to IAM Entity by Unusual User"
 35note = """## Triage and analysis
 36
 37### Investigating AWS SES Full Access Policy Attached to IAM Entity by Unusual User
 38
 39AWS Simple Email Service (SES) is a cost-effective bulk email platform with a reputation built on a customer's verified sending domains. Threat actors who compromise an AWS account often establish phishing infrastructure by granting SES access to a new or existing IAM identity and then using that identity's credentials to send phishing emails under the victim organization's trusted domain. Attaching the managed policy `AmazonSESFullAccess` is the simplest way to grant the full range of SES capabilities (send, manage identities, manage suppression lists, configure sending settings).
 40
 41This is a new terms rule that alerts only when the calling identity (`aws.cloudtrail.user_identity.arn`) has not attached this policy within the previous 7 days, prioritizing anomalous or first-time activity over recurring automation.
 42
 43### Possible investigation steps
 44
 45- Identify the caller in `aws.cloudtrail.user_identity.arn` and `user.name`. Determine whether the caller is a legitimate administrator or an anomalous identity.
 46- Identify the target IAM entity in `user.target.name` and `aws.cloudtrail.flattened.request_parameters.userName` (or `groupName` or `roleName`). Is this a known email automation account, or an entity created recently?
 47- Query CloudTrail for all SES API calls (`event.provider: ses.amazonaws.com`) from the target entity in the time window after this attachment. Look for `SendEmail`, `SendRawEmail`, `VerifyEmailIdentity`, `SetIdentityMailFromDomain`, or `UpdateAccountSendingEnabled`.
 48- Review whether the attachment corresponds to a legitimate change management process. Check for a corresponding IAM change window ticket.
 49- Verify whether SES sending is enabled for the account (`ses:GetAccountSendingEnabled`) and whether there are existing or recently created SES identities.
 50
 51### False positive analysis
 52
 53- Legitimate email automation services (transactional email, notification services) may attach AmazonSESFullAccess. Confirm the target entity is a known service role.
 54- CI/CD pipelines that manage email notification infrastructure may attach this policy. Validate via pipeline execution logs and source IP.
 55
 56### Response and remediation
 57
 58- If unauthorized, immediately detach AmazonSESFullAccess from the target entity and review all SES calls made under that identity.
 59- Review SES account sending status and disable sending if any unauthorized email was sent.
 60- Check SES suppression list for any unauthorized modifications (attackers may add or remove entries to influence deliverability).
 61- Rotate all credentials associated with both the calling identity and the target entity.
 62- Enable SES event publishing to review any emails sent during the unauthorized period.
 63"""
 64references = [
 65    "https://docs.aws.amazon.com/ses/latest/dg/control-user-access.html"
 66]
 67risk_score = 47
 68rule_id = "d2e3f4a5-b6c7-8901-bcde-f23456789012"
 69setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. No additional data event selectors are required — `iam:AttachUserPolicy`, `iam:AttachRolePolicy`, and `iam:AttachGroupPolicy` are management-plane APIs logged by default."
 70severity = "medium"
 71tags = [
 72    "Domain: Cloud",
 73    "Platform: AWS",
 74    "Data Source: AWS",
 75    "Data Source: Amazon Web Services",
 76    "Service: AWS IAM",
 77    "Service: AWS SES",
 78    "Rule Type: New Terms",
 79    "Tactic: Persistence",
 80    "Tactic: Resource Development",
 81    "Resources: Investigation Guide",
 82]
 83timestamp_override = "event.ingested"
 84type = "new_terms"
 85
 86query = '''
 87data_stream.dataset: "aws.cloudtrail"
 88    and event.provider: "iam.amazonaws.com"
 89    and event.action: ("AttachUserPolicy" or "AttachRolePolicy" or "AttachGroupPolicy")
 90    and event.outcome: "success"
 91    and aws.cloudtrail.flattened.request_parameters.policyArn: "arn:aws:iam::aws:policy/AmazonSESFullAccess"
 92'''
 93
 94
 95[[rule.threat]]
 96framework = "MITRE ATT&CK"
 97[[rule.threat.technique]]
 98id = "T1098"
 99name = "Account Manipulation"
100reference = "https://attack.mitre.org/techniques/T1098/"
101[[rule.threat.technique.subtechnique]]
102id = "T1098.003"
103name = "Additional Cloud Roles"
104reference = "https://attack.mitre.org/techniques/T1098/003/"
105
106
107[rule.threat.tactic]
108id = "TA0003"
109name = "Persistence"
110reference = "https://attack.mitre.org/tactics/TA0003/"
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113[[rule.threat.technique]]
114id = "T1608"
115name = "Stage Capabilities"
116reference = "https://attack.mitre.org/techniques/T1608/"
117
118
119[rule.threat.tactic]
120id = "TA0042"
121name = "Resource Development"
122reference = "https://attack.mitre.org/tactics/TA0042/"
123
124[rule.new_terms]
125field = "new_terms_fields"
126value = ["aws.cloudtrail.user_identity.arn"]
127[[rule.new_terms.history_window_start]]
128field = "history_window_start"
129value = "now-7d"
130
131[rule.investigation_fields]
132field_names = [
133    "@timestamp",
134    "aws.cloudtrail.user_identity.arn",
135    "aws.cloudtrail.user_identity.type",
136    "aws.cloudtrail.user_identity.access_key_id",
137    "user.name",
138    "user.target.name",
139    "event.action",
140    "event.outcome",
141    "aws.cloudtrail.request_parameters",
142    "source.ip",
143    "cloud.region",
144    "cloud.account.id",
145]