- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Classification:
attack
Detect when email sending is enabled in your Amazon SES account for the current AWS region.
Monitor CloudTrail and detect when email sending is enabled in your Amazon SES account for the current AWS region. Attackers target the AWS SES service generally for the purpose of phishing. To ensure the capbility to send email to their targets attackers will use the API calls UpdateAccountSendingEnabled
or PutAccountSendingAttributes
to enable email sending.
{{@evt.name}}
should have been made by the user: {{@userIdentity.arn}}
from this IP address: {{@network.client.ip}}
.{{@userIdentity.arn}}
and see if they made the API call.{{@userIdentity.arn}}
has taken other actions.{{@network.client.ip}}
.