Analytics BIOC
Informational
✕
SES Production Access Requested
An identity requested to move the SES account from a restricted sandbox mode into production mode.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Resource Development (TA0042)
ATT&CK techniques: Compromise Accounts: Email Accounts (T1586.002)
Attacker's goals:
Use the existing account to send phishing or spread malware at scale.
Investigative actions:
Check if the identity has performed any email-related operations in the past. Check if this account should be used for email sending.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- SES Production Access Requested by an unusual identity Low (parent: Informational)