AWS SES Enumeration via Long-Term Access Key

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS SES Enumeration via Long-Term Access Key

Detects enumeration of Amazon Simple Email Service (SES) resources using long-term IAM access keys (AKIA* prefix). Long-term access keys are associated with IAM users and are the credential type most commonly exfiltrated from repositories, configuration files, and environment variables. An adversary who obtains a long-term key may enumerate SES to discover verified email identities, sending quotas, and DKIM/MAIL FROM domain configurations as a precursor to phishing or spam campaigns launched from the compromised account’s verified domains.

Rule type: query

Rule indices:

logs-aws.cloudtrail-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Platform: AWS
Data Source: AWS CloudTrail
Service: AWS SES
Rule Type: Custom Query (KQL)
Tactic: Discovery
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating AWS SES Enumeration via Long-Term Access Key

Amazon SES verified identities (email addresses and domains) are the sending credentials that allow SES to send email on behalf of a domain. Adversaries who exfiltrate long-term IAM keys may enumerate SES to identify available verified domains for phishing, discover DKIM configurations, or check sending limits before launching a bulk email campaign.

Long-term keys (AKIA* prefix) are lower-security than assumed-role credentials: they do not expire and are frequently exposed in source code, .env files, CI/CD configuration, and developer workstations. This makes them the most common compromised credential type in cloud environments.

Possible investigation steps

Identify the IAM user behind the long-term key from aws.cloudtrail.user_identity.arn.
Check whether this access key has been rotated recently (GetAccessKeyLastUsed, ListAccessKeys). Confirm the user who owns the key initiated this activity.
Review source.ip and source.as.organization.name against known developer or automation infrastructure. API calls from unexpected geographies using a long-term key are high-risk.
Query CloudTrail for subsequent SES write operations (SendEmail, SendRawEmail, VerifyEmailIdentity, UpdateAccountSendingEnabled) using the same access key.
Check GitHub, GitLab, and CI/CD logs for any public exposure of this key.

Response and remediation

Immediately deactivate the long-term access key (UpdateAccessKey --status Inactive).
Rotate all credentials associated with the IAM user.
Review all SES quotas and sending history to determine whether unauthorized email was sent.
Migrate automation that used this key to IAM roles with short-lived assumed-role credentials.

Setup

edit

The AWS integration must be ingesting management events into logs-aws.cloudtrail-*. SES management APIs are logged by default.

Rule query

edit

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ses.amazonaws.com"
    and event.action: (
        "ListIdentities" or
        "GetAccountSendingEnabled" or
        "GetSendQuota" or
        "ListEmailIdentities" or
        "GetEmailIdentity" or
        "DescribeActiveReceiptRuleSet" or
        "ListReceiptRuleSets"
    )
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.access_key_id: AKIA*

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Discovery
- ID: TA0007
- Reference URL: https://attack.mitre.org/tactics/TA0007/
Technique:
- Name: Cloud Service Discovery
- ID: T1526
- Reference URL: https://attack.mitre.org/techniques/T1526/

« AWS Backup Resource Enumeration via Long-Term Access Key AWS S3 Bucket MFA Delete Disabled »