From 8fc90c464baddbc6d64a7d254ecc46525a2092f0 Mon Sep 17 00:00:00 2001 From: bryans3c Date: Fri, 14 Aug 2026 17:58:13 +0200 Subject: [PATCH 1/9] [New Rule] AWS SES Email Identity Verified Then Deleted --- ...nt_ses_identity_verified_then_deleted.toml | 123 ++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml new file mode 100644 index 00000000000..3dee6ffc0b3 --- /dev/null +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -0,0 +1,123 @@ +[metadata] +creation_date = "2026/08/14" +integration = ["aws"] +maturity = "production" +updated_date = "2026/08/14" + +[rule] +author = ["Elastic"] +description = """ +Detects the sequence of verifying an SES email identity and subsequently deleting it within +one hour, performed by the same AWS identity. Amazon SES requires email addresses and domains +to be verified before they can be used as senders. An adversary who obtains SES credentials +may verify a domain or address they control, use it to send phishing or spam email, then delete +the identity to remove evidence of the sending domain from the account's verified identity list. +This verify-use-delete pattern is a recognized attacker technique for SES abuse. +""" +false_positives = [ + """ + Testing workflows that verify a sandbox email address and then clean it up may trigger this + rule. Confirm that the email identity verified and deleted corresponds to a planned test + rather than a production or attacker-controlled domain. + """, +] +from = "now-6m" +index = ["logs-aws.cloudtrail-*"] +interval = "5m" +language = "eql" +license = "Elastic License v2" +name = "AWS SES Email Identity Verified Then Deleted" +note = """## Triage and analysis + +### Investigating AWS SES Email Identity Verified Then Deleted + +Amazon SES requires that email addresses and domains be verified (via DNS record or a verification email) before they can be used as `From:` addresses. An adversary who obtains SES write credentials can verify a domain they control, send bulk email from that domain using the victim account's sending quota and reputation, then delete the identity to hide the sending domain from security reviews. + +The verify-then-delete sequence is the evidence-destruction component of the SES phishing technique: it removes the compromised identity from `ListIdentities` output, making post-incident attribution harder. + +### Possible investigation steps + +- Identify the caller from `aws.cloudtrail.user_identity.arn` and `user.name`. +- Determine the verified identity from the `VerifyEmailIdentity` or `VerifyDomainIdentity` request parameters and the deleted identity from the `DeleteIdentity` request parameters. +- Query SES `SendEmail` / `SendRawEmail` CloudTrail events (if data events are enabled) or SES sending statistics between the verification and deletion timestamps to determine whether email was sent from the verified identity. +- Check your email service provider's delivery logs for any email sourced from the SES identity. +- Review all SES actions taken by this identity in the surrounding time window. + +### Response and remediation + +- If unauthorized email was sent, notify affected recipients and file an SES abuse report. +- Rotate all IAM credentials that had SES write access during the incident window. +- Enable SES sending quotas and alerts to detect unusual send volume in real time. +- Restrict `ses:VerifyEmailIdentity`, `ses:VerifyDomainIdentity`, and `ses:DeleteIdentity` to a dedicated SES-management role via IAM policy. +""" +references = [ + "https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyEmailIdentity.html", + "https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteIdentity.html", + "https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/", +] +risk_score = 73 +rule_id = "8e4bde35-125d-4eb3-9a2e-d7e77a053a08" +setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. SES management APIs are logged by default." +severity = "high" +tags = [ + "Domain: Cloud", + "Platform: AWS", + "Data Source: AWS CloudTrail", + "Rule Type: Event Correlation (EQL)", + "Tactic: Resource Development", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +sequence by aws.cloudtrail.user_identity.arn with maxspan=1h + [any where data_stream.dataset == "aws.cloudtrail" + and event.provider == "ses.amazonaws.com" + and event.action in ("VerifyEmailIdentity", "VerifyDomainIdentity", "VerifyEmailAddress", "VerifyDomainDkim") + and event.outcome == "success"] + [any where data_stream.dataset == "aws.cloudtrail" + and event.provider == "ses.amazonaws.com" + and event.action == "DeleteIdentity" + and event.outcome == "success"] +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1566" +name = "Phishing" +reference = "https://attack.mitre.org/techniques/T1566/" + + +[rule.threat.tactic] +id = "TA0042" +name = "Resource Development" +reference = "https://attack.mitre.org/tactics/TA0042/" +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1070" +name = "Indicator Removal" +reference = "https://attack.mitre.org/techniques/T1070/" + + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[rule.investigation_fields] +field_names = [ + "@timestamp", + "aws.cloudtrail.user_identity.arn", + "aws.cloudtrail.user_identity.type", + "aws.cloudtrail.user_identity.access_key_id", + "user.name", + "event.action", + "event.outcome", + "aws.cloudtrail.request_parameters", + "source.ip", + "cloud.account.id", +] From 17bb109df76a404d785f7901122a31b3cb1d4797 Mon Sep 17 00:00:00 2001 From: bryans3c Date: Fri, 14 Aug 2026 18:31:09 +0200 Subject: [PATCH 2/9] [New Rule] AWS SES Email Identity Verified Then Deleted --- .../resource_development_ses_identity_verified_then_deleted.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml index 3dee6ffc0b3..21d934d3d50 100644 --- a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -63,6 +63,7 @@ tags = [ "Domain: Cloud", "Platform: AWS", "Data Source: AWS CloudTrail", + "Service: AWS SES", "Rule Type: Event Correlation (EQL)", "Tactic: Resource Development", "Resources: Investigation Guide", From e55a94159c075b053a020b5df31e7e2f254952cf Mon Sep 17 00:00:00 2001 From: bryans3c Date: Fri, 14 Aug 2026 18:42:28 +0200 Subject: [PATCH 3/9] [New Rule] AWS SES Email Identity Verified Then Deleted --- .../resource_development_ses_identity_verified_then_deleted.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml index 21d934d3d50..2ca6c9e62b7 100644 --- a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -66,6 +66,7 @@ tags = [ "Service: AWS SES", "Rule Type: Event Correlation (EQL)", "Tactic: Resource Development", + "Tactic: Defense Evasion", "Resources: Investigation Guide", ] timestamp_override = "event.ingested" From 7362a03ad128027afd62bb0f9949bb9debdd4fed Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Fri, 14 Aug 2026 19:30:38 +0200 Subject: [PATCH 4/9] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- ...resource_development_ses_identity_verified_then_deleted.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml index 2ca6c9e62b7..ac2522678af 100644 --- a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -21,7 +21,7 @@ false_positives = [ rather than a production or attacker-controlled domain. """, ] -from = "now-6m" +from = "now-65m" index = ["logs-aws.cloudtrail-*"] interval = "5m" language = "eql" From 86aacaedb8d0d816c5eda6cdd3892e4e2a9e63ed Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Fri, 14 Aug 2026 19:31:15 +0200 Subject: [PATCH 5/9] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- ...velopment_ses_identity_verified_then_deleted.toml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml index ac2522678af..bafec5a698e 100644 --- a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -88,10 +88,14 @@ sequence by aws.cloudtrail.user_identity.arn with maxspan=1h [[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] -id = "T1566" -name = "Phishing" -reference = "https://attack.mitre.org/techniques/T1566/" - +id = "T1583" +name = "Acquire Infrastructure" +reference = "https://attack.mitre.org/techniques/T1583/" + +[[rule.threat.technique.subtechnique]] +id = "T1583.001" +name = "Domains" +reference = "https://attack.mitre.org/techniques/T1583/001/" [rule.threat.tactic] id = "TA0042" From 54782f85a5032c7ed182cb7c57622cdbd403f3b1 Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Fri, 14 Aug 2026 19:31:24 +0200 Subject: [PATCH 6/9] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- ...resource_development_ses_identity_verified_then_deleted.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml index bafec5a698e..48dd25efdac 100644 --- a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -39,7 +39,7 @@ The verify-then-delete sequence is the evidence-destruction component of the SES - Identify the caller from `aws.cloudtrail.user_identity.arn` and `user.name`. - Determine the verified identity from the `VerifyEmailIdentity` or `VerifyDomainIdentity` request parameters and the deleted identity from the `DeleteIdentity` request parameters. -- Query SES `SendEmail` / `SendRawEmail` CloudTrail events (if data events are enabled) or SES sending statistics between the verification and deletion timestamps to determine whether email was sent from the verified identity. +- Query SES `SendEmail` / `SendRawEmail` CloudTrail events (if CloudTrail management events are being collected) or SES sending statistics between the verification and deletion timestamps to determine whether email was sent from the verified identity. - Check your email service provider's delivery logs for any email sourced from the SES identity. - Review all SES actions taken by this identity in the surrounding time window. From 253c98e9c38782c5ff77d25dbb43d10d89e48557 Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Fri, 14 Aug 2026 19:40:15 +0200 Subject: [PATCH 7/9] Update resource_development_ses_identity_verified_then_deleted.toml --- ...source_development_ses_identity_verified_then_deleted.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml index 48dd25efdac..9955286c49d 100644 --- a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -21,7 +21,7 @@ false_positives = [ rather than a production or attacker-controlled domain. """, ] -from = "now-65m" +from = "now-35m" index = ["logs-aws.cloudtrail-*"] interval = "5m" language = "eql" @@ -73,7 +73,7 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -sequence by aws.cloudtrail.user_identity.arn with maxspan=1h +sequence by aws.cloudtrail.user_identity.arn with maxspan=30m [any where data_stream.dataset == "aws.cloudtrail" and event.provider == "ses.amazonaws.com" and event.action in ("VerifyEmailIdentity", "VerifyDomainIdentity", "VerifyEmailAddress", "VerifyDomainDkim") From 3d30a3883b71e0fa96c0224efd8b1302b164b99f Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Mon, 24 Aug 2026 11:13:48 +0200 Subject: [PATCH 8/9] Update resource_development_ses_identity_verified_then_deleted.toml From d165881507678fe7de436b82d619c36f1e1780d1 Mon Sep 17 00:00:00 2001 From: Bryan Porras Date: Mon, 24 Aug 2026 11:39:48 +0200 Subject: [PATCH 9/9] Update resource_development_ses_identity_verified_then_deleted.toml --- ...resource_development_ses_identity_verified_then_deleted.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml index 9955286c49d..e5f66d2c7c8 100644 --- a/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml +++ b/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml @@ -23,7 +23,7 @@ false_positives = [ ] from = "now-35m" index = ["logs-aws.cloudtrail-*"] -interval = "5m" +interval = "30m" language = "eql" license = "Elastic License v2" name = "AWS SES Email Identity Verified Then Deleted"