LoFP LoFP / testing workflows that verify a sandbox email address and then clean it up may trigger this rule. confirm that the email identity verified and deleted corresponds to a planned test rather than a production or attacker-controlled domain.

Techniques

Sample rules

AWS SES Email Identity Verified Then Deleted

Description

Detects an SES email identity being verified and subsequently deleted within a 30-minute window, performed by the same AWS identity. Amazon SES requires email addresses and domains to be verified before they can be used as senders. An adversary who obtains SES credentials may verify a domain or address they control, use it to send phishing or spam email, then delete the identity to remove evidence of the sending domain from the account’s verified identity list. This verify-use-delete pattern is a recognized attacker technique for SES abuse.

Detection logic

from logs-aws.cloudtrail-* metadata _id, _version, _index
| where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "ses.amazonaws.com"
    and event.action in ("VerifyEmailIdentity", "VerifyDomainIdentity", "VerifyEmailAddress", "VerifyDomainDkim", "DeleteIdentity")
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.arn is not null
| eval Esql.ses_verify_flag = case(event.action != "DeleteIdentity", 1, 0),
       Esql.ses_delete_flag = case(event.action == "DeleteIdentity", 1, 0)
| stats Esql.ses_verify_count = sum(Esql.ses_verify_flag),
        Esql.ses_delete_count = sum(Esql.ses_delete_flag),
        Esql.ses_verify_timestamp_min = min(case(Esql.ses_verify_flag == 1, @timestamp)),
        Esql.ses_delete_timestamp_max = max(case(Esql.ses_delete_flag == 1, @timestamp)),
        Esql.event_action_values = values(event.action),
        Esql_priv.user_name_values = values(user.name),
        Esql.cloud_account_id_values = values(cloud.account.id)
    by aws.cloudtrail.user_identity.arn
| where Esql.ses_verify_count > 0 and Esql.ses_delete_count > 0
    and Esql.ses_verify_timestamp_min < Esql.ses_delete_timestamp_max
    and date_diff("minutes", Esql.ses_verify_timestamp_min, Esql.ses_delete_timestamp_max) <= 30
| keep aws.cloudtrail.user_identity.arn, Esql.ses_verify_count, Esql.ses_delete_count, Esql.ses_verify_timestamp_min, Esql.ses_delete_timestamp_max, Esql.event_action_values, Esql_priv.user_name_values, Esql.cloud_account_id_values