Unusual Attachment of AmazonSESFullAccess Policy in AWS

Threat actors who gain unauthorized access to an AWS environment may attach the AmazonSESFullAccess managed policy to an IAM entity, such as a user, role, or group. This managed policy provides unrestricted permissions to perform sensitive SES actions, including sending emails, verifying new email identities, managing suppression lists, and modifying account-level sending settings.

This activity is commonly observed as a means for attackers to build phishing infrastructure within a compromised cloud environment. By granting these permissions, an attacker can leverage the victim organization's trusted, verified sending domain to send bulk phishing emails, significantly increasing the probability of successful social engineering campaigns. Defenders should prioritize alerting on first-time or unusual associations of this policy, as routine email automation services may legitimately perform these attachments.

Attack Chain

1. Attacker gains initial access to an AWS environment via compromised IAM credentials or an insecure identity.
2. Attacker performs discovery to identify existing IAM users, roles, or groups for potential escalation.
3. Attacker evaluates the permissions of the current identity to determine if they can attach managed policies (iam:AttachUserPolicy, iam:AttachRolePolicy, or iam:AttachGroupPolicy).
4. Attacker attaches the AmazonSESFullAccess policy to a controlled IAM entity to gain full SES control.
5. Attacker verifies SES account sending status via iam:GetAccountSendingEnabled.
6. Attacker uses ses:VerifyEmailIdentity or ses:SetIdentityMailFromDomain to establish control over malicious sending domains.
7. Attacker proceeds to execute mass phishing campaigns via ses:SendEmail or ses:SendRawEmail while utilizing the victim's domain reputation.

Impact

The primary impact is the unauthorized use of the organization's verified domain reputation to distribute phishing content. This can lead to domain blacklisting, reputational damage, and increased exposure for employees and partners who receive the fraudulent emails. Additionally, if an attacker modifies the account's suppression list or sending settings, they can disrupt legitimate business communications and bypass security controls.

Recommendation

• Monitor AWS CloudTrail management events for the AmazonSESFullAccess policy attachment to any IAM entity.
• Establish a baseline of identities authorized to modify IAM policies and SES configurations; investigate any deviations from this baseline.
• Review SES account sending status and current identity verifications after any unauthorized IAM policy changes.
• Implement the detection rule below to surface first-time policy attachments by specific calling identities.
• Rotate credentials for any IAM identity involved in unauthorized policy modification or SES activity.