[AWS-SES] Simple Email Service Discovery Command Event Detected (GetSendQuota)

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-SES] Simple Email Service Discovery Command Event Detected (GetSendQuota)"; program:ses.amazonaws.com; content:"eventName
| 22 3a 20 22
| GetSendQuota"; content:"
| 3a
| role
| 2f
| aws-service-role
| 2f
| "; content:!"
| 22
| userName
| 22 3a 20 22
| DatadogIntegrationRole
| 22
| "; parse_src_ip: 1; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; classtype:discovery; reference:url,https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/; sid:5015087; rev:1; metadata:mitre_tactic_id TA0007;)