New attack technique: SES enumeration activities

[loresuso]

What does this PR do?

New attack technique

Motivation

Attackers may use AWS SES to send phishing emails from a victim's AWS account. One of the objectives of the attackers could be sending as many emails as possible from a verified source to start a phishing campaign. Before doing that, and as described by this research , they can call some APIs for enumeration, like ses:GetSendQuota and ses:ListIdentities

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up

[christophetd]

Thanks for the PR! Will review it in the coming days

[loresuso]

Thank you @christophetd!

[christophetd]

When an attacker wants to enumerate SES, they can achieve the same outcome in two different ways:

1. Use sesv2:GetAccount and read quotas in place and whether e-mail sending is enabled from the response
2. Use ses:GetAccountSendingEnabled + ses:GetSendQuota individually

Not sure which one we should be using, any thoughts? I've also asked in the Cloud Security Forum Slack

[christophetd]

@loresuso I've made a few changes to make enumeration slightly more aggressive, are you comfortable with the changes and can you have a look? Thanks!

[loresuso]

We are aware of the two alternatives, but initially thought to use GetSendQuota just because the GetAccount API call wasn't mentioned in the article we linked. Thinking about it, GetAccount should be better from an attacker's point of view because:

• it will produce fewer logs (just one call instead of two)
• it can provide even more additional details in the response, so it is better for enumeration https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetAccount.html#API_GetAccount_ResponseSyntax

[loresuso]

By the way, thanks, the changes look good to me, especially the additional step with the GetIdentityVerificationAttributes call

[loresuso]

I think everything is good, when you want we can get this merged :) @christophetd

I also have another question: I believe we could also implement another technique where we try to send an email using ses:SendEmail API. What do you think? How would you map it to MITRE ATT&CK? Curious to know your opinion about it!

[christophetd]

If we can find evidence that it's been abused in the wild (e.g. write-up) yes it would be perfect