Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0042 ✕ technique: T1586 ✕

Download CSV Show ATT&CK heatmap
  • SES Production Access Requested Informational Cloud 1 variation

    An identity requested to move the SES account from a restricted sandbox mode into production mode.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Resource Development (TA0042)
    ATT&CK techniques: Compromise Accounts: Email Accounts (T1586.002)
    Required data: AWS Audit Log
    Attacker's goals: Use the existing account to send phishing or spread malware at scale.
    Investigative actions: Check if the identity has performed any email-related operations in the past. Check if this account should be used for email sending.

    Variations

    SES Production Access Requested by an unusual identity

    Low overridden

    An identity requested to move the SES account from a restricted sandbox mode into production mode. The identity was not seen performing any operations in SES in the last 30 days. overridden