Detects when Amazon SES account-level email sending is explicitly re-enabled in a region by calling ses:UpdateAccountSendingEnabled (v1) with Enabled: true or ses:PutAccountSendingAttributes (v2) with SendingEnabled: true. These API calls lift a sender pause or enable sending in response to reputation-driven actions, and may be abused by an adversary with SES permissions to restore phishing infrastructure. The rule monitors CloudTrail management events for SES API calls to ses.amazonaws.com, requiring a successful outcome and parameters indicating enabled sending. It excludes calls originating from common infrastructure-as-code tools to reduce noise. False positives may occur when legitimate administrators re-enable sending after maintenance or investigations; validate against change-management records. Recommended response includes revoking the caller’s session, disabling account-level sending, reviewing SES identities and sending policies, and checking for anomalous sending activity or related privilege-escalation events. The detection aligns with MITRE ATT&CK T1608 (Stage Capabilities) under TA0042 (Resource Development), illustrating how an attacker could reconstitute capabilities for phishing infrastructure. The rule uses CloudTrail data, focusing on the aws.cloudtrail dataset with event.provider ses.amazonaws.com and event.action in {UpdateAccountSendingEnabled, PutAccountSendingAttributes} and a successful outcome, while filtering out automation tools via user_agent. Practically, this helps identify a pivot from a paused state to active bulk email in a region, potentially indicating account compromise or policy circumvention.