[AWS-SES] Simple Email Service Discovery Event Detected (ListIdentities)

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-SES] Simple Email Service Discovery Event Detected (ListIdentities)"; program:ses.amazonaws.com; content:"eventName
| 22 3a 20 22
| ListIdentities"; parse_src_ip: 1; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; content: !"Datadog"; nocase;  classtype:discovery; reference:url,https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/; sid:5015091; rev:1; metadata:mitre_tactic_id TA0007;)