Detection rules › Sigma

SES Identity Has Been Deleted

Status
test
Severity
medium
Log source
product aws, service cloudtrail
Author
Janantha Marasinghe
Source
github.com/SigmaHQ/sigma

Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities

MITRE ATT&CK coverage

TacticTechniques
StealthT1070 Indicator Removal

Event coverage

Rule body yaml

title: SES Identity Has Been Deleted
id: 20f754db-d025-4a8f-9d74-e0037e999a9a
status: test
description: Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities
references:
    - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
author: Janantha Marasinghe
date: 2022-12-13
modified: 2022-12-28
tags:
    - attack.stealth
    - attack.t1070
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ses.amazonaws.com'
        eventName: 'DeleteIdentity'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    eventSource: 'ses.amazonaws.com'
    eventName: 'DeleteIdentity'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
eventNameeq
  • DeleteIdentity
eventSourceeq
  • ses.amazonaws.com