Abuse of AWS SES Account-Level Email Sending

Attackers who compromise AWS environments frequently seek to leverage existing cloud services for malicious operations. A specific tactic involves re-enabling email sending capabilities within Amazon Simple Email Service (SES). By invoking the v1 UpdateAccountSendingEnabled API or the v2 PutAccountSendingAttributes API, an attacker can override an existing administrative pause on email sending. This capability is critical for establishing phishing infrastructure that utilizes the victim organization's trusted, high-reputation domain to bypass email security filters. Because these APIs are rarely invoked in standard production environments, successful execution by unauthorized identities serves as a high-fidelity indicator of potential infrastructure staging for further abuse.

Impact

Successful abuse of this capability allows attackers to conduct bulk email campaigns using the compromised entity's reputation, significantly increasing the probability of phishing success. This activity often precedes large-scale email fraud, brand impersonation, or credential theft campaigns, potentially leading to reputational damage and the blacklisting of the organization's legitimate sending domains by major mail providers.

Recommendation

• Deploy the provided Sigma rule to monitor aws.cloudtrail logs for successful calls to UpdateAccountSendingEnabled or PutAccountSendingAttributes where the sending status is enabled.
• Establish an alert for any manual change to SES account sending status that does not correlate with an authorized change management ticket.
• Review SES sending statistics and identity configurations for unauthorized verified domains or templates immediately following any alert trigger.
• Ensure that IAM roles and users with ses:UpdateAccountSendingEnabled or ses:PutAccountSendingAttributes permissions are restricted according to the principle of least privilege.