{"id":"20f754db-d025-4a8f-9d74-e0037e999a9a","title":"SES Identity Has Been Deleted","description":"Detects an instance of an SES identity being deleted via the \"DeleteIdentity\" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities","author":"Janantha Marasinghe","status":"test","level":"medium","date":"2022-12-13","modified":"2022-12-28","tags":["attack.stealth","attack.t1070"],"technique_ids":["T1070"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Unknown"],"references":["https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/"],"source_path":"rules/cloud/aws/cloudtrail/aws_delete_identity.yml","source_sha256":"5a85ec99a1c6feb1457a5999557a91624576a70b73253830a0b88230f05191d0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_delete_identity.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: SES Identity Has Been Deleted\nid: 20f754db-d025-4a8f-9d74-e0037e999a9a\nstatus: test\ndescription: Detects an instance of an SES identity being deleted via the \"DeleteIdentity\" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities\nreferences:\n    - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/\nauthor: Janantha Marasinghe\ndate: 2022-12-13\nmodified: 2022-12-28\ntags:\n    - attack.stealth\n    - attack.t1070\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: 'ses.amazonaws.com'\n        eventName: 'DeleteIdentity'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","page":"techniques/enterprise/T1070/"}],"data_path":"data/detection-rules/20f754db-d025-4a8f-9d74-e0037e999a9a.json","kind":"sigma"}