AWS SES Identity Deletion via CloudTrail DeleteIdentity Event

title: AWS SES Identity Deletion via CloudTrail DeleteIdentity Event
id: 98ab29b7-fe19-4563-a635-4054b20c9e16
status: test
description: This rule identifies when an Amazon Simple Email Service (SES) identity is deleted by matching CloudTrail events with eventSource ses.amazonaws.com and eventName DeleteIdentity. Deleting an SES identity can remove an email identity used for sending or related workflows, which attackers may do to reduce access or remove evidence tied to prior activity. The detection relies on AWS CloudTrail telemetry capturing SES management API calls, specifically the DeleteIdentity action.
references:
  - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_delete_identity.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-12-13
modified: 2022-12-28
tags:
  - attack.stealth
  - attack.t1070
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ses.amazonaws.com
    eventName: DeleteIdentity
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 20f754db-d025-4a8f-9d74-e0037e999a9a
    type: derived