AWS SES Identity Deleted via CloudTrail DeleteIdentity Event
Flags CloudTrail events showing an SES identity was deleted using the DeleteIdentity API.
FreeReviewedSigma · Medium · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Janantha Marasinghe (SigmaHQ), DRL 1.1
- Published
- 2022-12-13
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when an Amazon SES identity is deleted using the CloudTrail event for the DeleteIdentity API call. Deleting identities can be used to remove evidence or disrupt previously configured sending capabilities after suspicious activity. The detection relies on AWS CloudTrail logs containing eventSource ses.amazonaws.com and eventName DeleteIdentity.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-ses-identity-deletion-via-cloudtrail-deleteidentity-event-20f754db
title: AWS SES Identity Deleted via CloudTrail DeleteIdentity Event
id: 98ab29b7-fe19-4563-a635-4054b20c9e16
status: test
description: This rule identifies when an Amazon SES identity is deleted using the CloudTrail event for the DeleteIdentity API call. Deleting identities can be used to remove evidence or disrupt previously configured sending capabilities after suspicious activity. The detection relies on AWS CloudTrail logs containing eventSource ses.amazonaws.com and eventName DeleteIdentity.
references:
- https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_delete_identity.yml
author: Janantha Marasinghe, Huntrule Team
date: 2022-12-13
modified: 2022-12-28
tags:
- attack.stealth
- attack.t1070
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: ses.amazonaws.com
eventName: DeleteIdentity
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 20f754db-d025-4a8f-9d74-e0037e999a9a
type: derived