Cloud email sending was enabled

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2025-06-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts: Email Accounts (T1586.002)
Severity	Informational

Cloud email sending was enabled for the cloud account.

Use the existing account to send phishing or spread malware.

ATT&CK Tactic	Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts: Email Accounts (T1586.002)
Severity	Low

Cloud email sending was enabled for the cloud account.
The identity was not seen performing any operations in SES in the last 30 days.

Use the existing account to send phishing or spread malware.