AWS SES

Threat actors with compromised AWS credentials may enable account-level email sending in Amazon SES to restore suspended infrastructure for mass phishing campaigns.

Threat actors may attach the AmazonSESFullAccess policy to IAM entities to establish phishing infrastructure and send emails using a victim organization's verified domain.

An Elastic detection rule identifies when a single AWS identity, using the AWS CLI, performs more than five distinct read-only discovery API calls (such as Describe*, List*, Get*, and Generate*) across various AWS services within a 10-second window, indicating reconnaissance by an adversary using compromised credentials or an exploited EC2 instance to map the AWS infrastructure for potential targets and further exploitation.