Amazon SES relay IP with amazonses.com DKIM signature on unexpected subdomain
Detects inbound email messages authenticated with an amazonses.com DKIM signature that originate from a specific Amazon SES Tokyo-region relay IP address. This may indicate an adversary is leveraging a compromised or unauthorized transactional email account (e.g., SES or third-party platforms like Resend) to send emails on behalf of a victim domain.
Microsoft Sentinel (KQL)
