AWS SES

Threat actors may attach the AmazonSESFullAccess policy to IAM entities to establish phishing infrastructure and send emails using a victim organization's verified domain.

An Elastic detection rule identifies when a single AWS identity, using the AWS CLI, performs more than five distinct read-only discovery API calls (such as Describe*, List*, Get*, and Generate*) across various AWS services within a 10-second window, indicating reconnaissance by an adversary using compromised credentials or an exploited EC2 instance to map the AWS infrastructure for potential targets and further exploitation.