AWS SES Email Identity Verified Then Deleted

  1[metadata]
  2creation_date = "2026/08/31"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/31"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an SES email identity being verified and subsequently deleted within a 30-minute window,
 11performed by the same AWS identity. Amazon SES requires email addresses and domains
 12to be verified before they can be used as senders. An adversary who obtains SES credentials
 13may verify a domain or address they control, use it to send phishing or spam email, then delete
 14the identity to remove evidence of the sending domain from the account's verified identity list.
 15This verify-use-delete pattern is a recognized attacker technique for SES abuse.
 16"""
 17false_positives = [
 18    """
 19    Testing workflows that verify a sandbox email address and then clean it up may trigger this
 20    rule. Confirm that the email identity verified and deleted corresponds to a planned test
 21    rather than a production or attacker-controlled domain.
 22    """,
 23]
 24from = "now-60m"
 25interval = "30m"
 26language = "esql"
 27license = "Elastic License v2"
 28name = "AWS SES Email Identity Verified Then Deleted"
 29note = """## Triage and analysis
 30
 31### Investigating AWS SES Email Identity Verified Then Deleted
 32
 33Amazon SES requires that email addresses and domains be verified (via DNS record or a verification email) before they can be used as `From:` addresses. An adversary who obtains SES write credentials can verify a domain they control, send bulk email from that domain using the victim account's sending quota and reputation, then delete the identity to hide the sending domain from security reviews.
 34
 35The verify-then-delete sequence is the evidence-destruction component of the SES phishing technique: it removes the compromised identity from `ListIdentities` output, making post-incident attribution harder.
 36
 37This is an ES|QL rule that aggregates SES verification and deletion events per calling identity within 30-minute windows and alerts when the same identity performed both, with the verification preceding the deletion.
 38
 39### Possible investigation steps
 40
 41- Identify the caller from `aws.cloudtrail.user_identity.arn` and the aggregated `user_names` column.
 42- Pivot to the raw CloudTrail events for this ARN in the `first_verify` to `last_delete` time range to determine the verified identity from the `VerifyEmailIdentity` or `VerifyDomainIdentity` request parameters and the deleted identity from the `DeleteIdentity` request parameters.
 43- Query SES `SendEmail` / `SendRawEmail` CloudTrail events (if CloudTrail management events are being collected) or SES sending statistics between the verification and deletion timestamps to determine whether email was sent from the verified identity.
 44- Check your email service provider's delivery logs for any email sourced from the SES identity.
 45- Review all SES actions taken by this identity in the surrounding time window.
 46
 47### Response and remediation
 48
 49- If unauthorized email was sent, notify affected recipients and file an SES abuse report.
 50- Rotate all IAM credentials that had SES write access during the incident window.
 51- Enable SES sending quotas and alerts to detect unusual send volume in real time.
 52- Restrict `ses:VerifyEmailIdentity`, `ses:VerifyDomainIdentity`, and `ses:DeleteIdentity` to a dedicated SES-management role via IAM policy.
 53"""
 54references = [
 55    "https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyEmailIdentity.html",
 56    "https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteIdentity.html",
 57    "https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/",
 58]
 59risk_score = 47
 60rule_id = "8e4bde35-125d-4eb3-9a2e-d7e77a053a08"
 61setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. SES management APIs are logged by default."
 62severity = "medium"
 63tags = [
 64    "Domain: Cloud",
 65    "Platform: AWS",
 66    "Data Source: AWS CloudTrail",
 67    "Service: AWS SES",
 68    "Rule Type: ESQL",
 69    "Tactic: Resource Development",
 70    "Tactic: Defense Evasion",
 71    "Resources: Investigation Guide",
 72]
 73timestamp_override = "event.ingested"
 74type = "esql"
 75
 76query = '''
 77from logs-aws.cloudtrail-* metadata _id, _version, _index
 78| where data_stream.dataset == "aws.cloudtrail"
 79    and event.provider == "ses.amazonaws.com"
 80    and event.action in ("VerifyEmailIdentity", "VerifyDomainIdentity", "VerifyEmailAddress", "VerifyDomainDkim", "DeleteIdentity")
 81    and event.outcome == "success"
 82    and aws.cloudtrail.user_identity.arn is not null
 83| eval Esql.ses_verify_flag = case(event.action != "DeleteIdentity", 1, 0),
 84       Esql.ses_delete_flag = case(event.action == "DeleteIdentity", 1, 0)
 85| stats Esql.ses_verify_count = sum(Esql.ses_verify_flag),
 86        Esql.ses_delete_count = sum(Esql.ses_delete_flag),
 87        Esql.ses_verify_timestamp_min = min(case(Esql.ses_verify_flag == 1, @timestamp)),
 88        Esql.ses_delete_timestamp_max = max(case(Esql.ses_delete_flag == 1, @timestamp)),
 89        Esql.event_action_values = values(event.action),
 90        Esql_priv.user_name_values = values(user.name),
 91        Esql.cloud_account_id_values = values(cloud.account.id)
 92    by aws.cloudtrail.user_identity.arn
 93| where Esql.ses_verify_count > 0 and Esql.ses_delete_count > 0
 94    and Esql.ses_verify_timestamp_min < Esql.ses_delete_timestamp_max
 95    and date_diff("minutes", Esql.ses_verify_timestamp_min, Esql.ses_delete_timestamp_max) <= 30
 96| keep aws.cloudtrail.user_identity.arn, Esql.ses_verify_count, Esql.ses_delete_count, Esql.ses_verify_timestamp_min, Esql.ses_delete_timestamp_max, Esql.event_action_values, Esql_priv.user_name_values, Esql.cloud_account_id_values
 97'''
 98
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102[[rule.threat.technique]]
103id = "T1583"
104name = "Acquire Infrastructure"
105reference = "https://attack.mitre.org/techniques/T1583/"
106
107[[rule.threat.technique.subtechnique]]
108id = "T1583.001"
109name = "Domains"
110reference = "https://attack.mitre.org/techniques/T1583/001/"
111
112[rule.threat.tactic]
113id = "TA0042"
114name = "Resource Development"
115reference = "https://attack.mitre.org/tactics/TA0042/"
116[[rule.threat]]
117framework = "MITRE ATT&CK"
118[[rule.threat.technique]]
119id = "T1070"
120name = "Indicator Removal"
121reference = "https://attack.mitre.org/techniques/T1070/"
122
123
124[rule.threat.tactic]
125id = "TA0005"
126name = "Defense Evasion"
127reference = "https://attack.mitre.org/tactics/TA0005/"
128
129[rule.investigation_fields]
130field_names = [
131    "aws.cloudtrail.user_identity.arn",
132    "Esql.ses_verify_count",
133    "Esql.ses_delete_count",
134    "Esql.ses_verify_timestamp_min",
135    "Esql.ses_delete_timestamp_max",
136    "Esql.event_action_values",
137    "Esql_priv.user_name_values",
138    "Esql.cloud_account_id_values",
139]