Analytics BIOC Informational
✕

AWS SES account sending settings modified

AWS SES account sending settings were modified.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Valid Accounts (T1078)
Attacker's goals:

Gain access to confidential emails of an organization. Compromise the organization's cloud Email infrastructure.

Investigative actions:

Check whether the SES Email sending setting modification was intentional.

Test period:
N/A (single event)
Deduplication:
5 Days