Detects a suspicious SES usage pattern where an AWS SES identity is verified and subsequently deleted within a 30-minute window by the same AWS identity. Since Amazon SES requires domain/email verification before sending, an adversary with SES credentials can verify an identity to enable sending, then delete the identity to obscure activity and hinder incident response. The rule aggregates SES verification and deletion events per calling identity within a 30-minute window and raises an alert when a verification action occurs prior to a deletion action by the same principal. It relies on CloudTrail data (logs-aws.cloudtrail-*) and filters for SES-related actions such as VerifyEmailIdentity, VerifyDomainIdentity, VerifyEmailAddress, VerifyDomainDkim, and DeleteIdentity, ensuring the events come from a non-null aws.cloudtrail.user_identity.arn. The detection logic surfaces counts and timestamps for verification and deletion, enabling investigators to inspect the sequence and correlate with potential sending activity via SendEmail/SendRawEmail events. The rule includes an investigation and remediation focus, listing steps to identify the caller ARN, reconstruct the verified and deleted identities, check sending activity, and review SES actions within the window. Mitigation guidance includes rotating credentials with SES write access, tightening IAM permissions (restrict positive actions like VerifyIdentity and DeleteIdentity to a dedicated management role), and enabling real-time sending quotas/alerts to detect anomalous SES use.