Service: AWS SES

AWS SES Account Email Sending Enabled

Sep 8, 2026 · Domain: Cloud Platform: AWS Data Source: AWS CloudTrail Service: AWS SES Rule Type: Custom Query (KQL) Tactic: Resource Development Resources: Investigation Guide ·

Share on:

Detects when account-level email sending is explicitly enabled in Amazon SES, via the v1 UpdateAccountSendingEnabled API with Enabled: true or the v2 PutAccountSendingAttributes API with SendingEnabled: true. Account-level sending is commonly paused by an administrator, or by automation wired to CloudWatch reputation alarms when bounce or complaint rates rise. An attacker who compromises an AWS account may re-enable sending to restore a paused capability as part of phishing infrastructure setup, allowing bulk email under the victim organization's trusted sending domain. Neither API can resume sending that AWS itself has paused.

AWS SES Enumeration via Long-Term Access Key

Sep 7, 2026 · Domain: Cloud Platform: AWS Data Source: AWS CloudTrail Service: AWS SES Rule Type: Custom Query (KQL) Tactic: Discovery Resources: Investigation Guide ·

Share on:

Detects enumeration of Amazon Simple Email Service (SES) resources using long-term IAM access keys (AKIA* prefix). Long-term access keys are associated with IAM users and are the credential type most commonly exfiltrated from repositories, configuration files, and environment variables. An adversary who obtains a long-term key may enumerate SES to discover verified email identities, sending quotas, and DKIM/MAIL FROM domain configurations as a precursor to phishing or spam campaigns launched from the compromised account's verified domains.

AWS SES Email Identity Verified Then Deleted

Aug 31, 2026 · Domain: Cloud Platform: AWS Data Source: AWS CloudTrail Service: AWS SES Rule Type: ESQL Tactic: Resource Development Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Detects an SES email identity being verified and subsequently deleted within a 30-minute window, performed by the same AWS identity. Amazon SES requires email addresses and domains to be verified before they can be used as senders. An adversary who obtains SES credentials may verify a domain or address they control, use it to send phishing or spam email, then delete the identity to remove evidence of the sending domain from the account's verified identity list. This verify-use-delete pattern is a recognized attacker technique for SES abuse.

AWS SES Full Access Policy Attached to IAM Entity by Unusual User

Aug 31, 2026 · Domain: Cloud Platform: AWS Data Source: AWS Data Source: Amazon Web Services Service: AWS IAM Service: AWS SES Rule Type: New Terms Tactic: Persistence Tactic: Resource Development Resources: Investigation Guide ·

Share on:

Detects the first occurrence in 7 days of an AWS identity attaching the managed policy AmazonSESFullAccess to an IAM user, role, or group. AmazonSESFullAccess grants unrestricted permission to send email, manage identities and templates, manage suppression lists, and access SES account-level settings. Granting this policy to an unexpected IAM entity, particularly a newly created user or a role not previously associated with email operations, is a documented technique used by threat actors to establish phishing infrastructure on compromised AWS accounts, enabling them to send email on behalf of the victim organization's trusted sending domain. Using new terms on the calling identity suppresses recurring attachments by known email automation while surfacing identities performing this action for the first time.