This rule detects the first occurrence in the last seven days where an AWS IAM entity (user, role, or group) attaches the AWS managed policy AmazonSESFullAccess to itself or another entity. The policy grants full SES capabilities (sending emails, managing identities and templates, suppression lists, and account-level settings). By focusing on first-time attachments (new terms) within a rolling 7-day window, the rule prioritizes anomalous activity over recurring automation, which threat actors may leverage to establish phishing infrastructure using the organization’s trusted sending domain. The detection is based on CloudTrail management events and surfaces the calling identity (aws.cloudtrail.user_identity.arn) and the target entity for rapid triage. The rule is intended to surface potentially unauthorized configurations that could enable mass phishing or identity verification abuse via SES.