SES Identity Has Been Deleted

Title: SES Identity Has Been Deleted
Status: test
Description:Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities
References:
  -https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
Author: Janantha Marasinghe
Date: 2022-12-13
modified:2022-12-28
Tags:

• -'attack.stealth'
• -'attack.t1070'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventSource: 'ses.amazonaws.com'
    eventName: 'DeleteIdentity'
  condition:selection
Falsepositives:
  -Unknown
Level: medium