Detection of AWS SES Identity Verify-Use-Delete Abusive Pattern

Adversaries who obtain unauthorized AWS credentials with SES permissions often abuse the service to send bulk unsolicited email using the victim account's reputation and sending quota. To minimize the forensic footprint, attackers employ a specific 'verify-use-delete' technique. This involves programmatically verifying a domain or email identity they control, utilizing the account to send malicious traffic, and subsequently deleting the identity within a short timeframe (typically under 30 minutes). This deletion removes the evidence from the account's verified identity list, complicating post-incident forensic review and attribution. Defenders must monitor CloudTrail management events to identify this rapid lifecycle of SES identities.

Attack Chain

1. Attacker gains unauthorized access to AWS credentials with SES write permissions (e.g., via leaked access keys or compromised IAM roles).
2. Attacker calls VerifyDomainIdentity or VerifyEmailIdentity to register an attacker-controlled domain or email address within the victim's AWS environment.
3. Attacker completes the domain verification process (e.g., via DNS record validation).
4. Attacker uses the SendEmail or SendRawEmail API actions to dispatch phishing or spam campaigns using the victim's reputation.
5. Attacker calls DeleteIdentity to remove the domain or email address from the account.
6. Victim's list of verified SES identities no longer shows the attacker's domain, effectively hiding the configuration used for the malicious campaign.

Impact

Successful abuse of AWS SES results in the degradation of the victim account's email sender reputation, potential blacklisting by major email providers, and utilization of the organization's email sending quotas for malicious activities. Furthermore, the rapid deletion of identities hinders security teams' ability to perform root cause analysis and attribute the campaign to a specific domain or sender, potentially leading to persistent or recurring abuse.

Recommendation

• Implement the detection logic provided in this brief to alert on the verify-then-delete pattern observed in CloudTrail logs.
• Restrict the ses:VerifyEmailIdentity, ses:VerifyDomainIdentity, and ses:DeleteIdentity IAM actions to a dedicated SES-management role using Least Privilege principles.
• Enable SES sending quotas and configured alerts to identify anomalous traffic spikes in real time.
• Review all SES management events if a sudden drop in account sender reputation or an abuse complaint from an external provider is identified.