Elastic low stable kql

AWS SES Enumeration via Long-Term Access Key

Detects enumeration of Amazon Simple Email Service (SES) resources using long-term IAM access keys (AKIA* prefix). Long-term access keys are associated with IAM users and are the credential type most commonly exfiltrated from repositories, configuration files, and environment variables. An adversary who obtains a long-term key may enumerate SES to discover verified email identities, sending quotas, and DKIM/MAIL FROM domain configurations as a precursor to phishing or spam campaigns launched from the compromised account's verified domains.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ses.amazonaws.com"
    and event.action: (
        "ListIdentities" or
        "GetAccountSendingEnabled" or
        "GetSendQuota" or
        "ListEmailIdentities" or
        "GetEmailIdentity" or
        "DescribeActiveReceiptRuleSet" or
        "ListReceiptRuleSets"
    )
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.access_key_id: AKIA*

False Positives

⚠ Automated monitoring scripts, infrastructure inventory tools, or CI/CD pipelines that use long-term IAM keys to audit SES configuration will trigger this rule. Migrate automation to IAM roles with short-lived credentials; long-term keys used for SES management are a security anti-pattern regardless of this alert.

Field Validations

Loading…

Comments (0)

Loading comments...