Elastic Security Detection Rules

AWS SES Enumeration via Long-Term Access Key

Last updated a month ago on 2026-09-18
Created 2 months ago on 2026-08-24

About

Detects enumeration of Amazon Simple Email Service (SES) resources using long-term IAM access keys (AKIA* prefix). Long-term access keys are associated with IAM users and are the credential type most commonly exfiltrated from repositories, configuration files, and environment variables. An adversary who obtains a long-term key may enumerate SES to discover verified email identities, sending quotas, and DKIM/MAIL FROM domain configurations as a precursor to phishing or spam campaigns launched from the compromised account's verified domains.
Tags
Domain: CloudData Source: AWSData Source: Amazon Web ServicesPlatform: AWSData Source: AWS CloudTrailService: AWS SESRule Type: Custom Query (KQL)Tactic: DiscoveryLanguage: kuery
Severity
low
Risk Score
21
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ Cloud Service Discovery (T1526)(external, opens in a new tab or window)

False Positive Examples
Automated monitoring scripts, infrastructure inventory tools, or CI/CD pipelines that use long-term IAM keys to audit SES configuration will trigger this rule. Migrate automation to IAM roles with short-lived credentials; long-term keys used for SES management are a security anti-pattern regardless of this alert.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-aws.cloudtrail-*
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ses.amazonaws.com"
    and event.action: (
        "ListIdentities" or
        "GetAccountSendingEnabled" or
        "GetSendQuota" or
        "ListEmailIdentities" or
        "GetEmailIdentity" or
        "DescribeActiveReceiptRuleSet" or
        "ListReceiptRuleSets"
    )
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.access_key_id: AKIA*

Install detection rules in Elastic Security

Detect AWS SES Enumeration via Long-Term Access Key in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).