AWS SES Email Enumeration Detection

Lacey Cochrane@NullVectorX

•updated Mar 16, 2026•2•0•66

Detects enumeration of AWS SES email identities and sending quotas. This activity can indicate an attacker performing reconnaissance before launching phishing or Business Email Compromise (BEC) attacks. The rule identifies multiple distinct SES operations related to identity and quota checks performed by a single user within a two-hour window.