AWS CloudTrail: EFS Mount Target Deleted or Modified

Detects CloudTrail-reported deletion of an AWS EFS mount target that can break dependent instances or applications.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-efs-mount-target-deleted-or-modified-6a7ba45c

title: "AWS CloudTrail: EFS Mount Target Deleted or Modified"
id: f27f4290-230e-4e2c-ba9f-faf2a331a9c2
status: test
description: This rule flags CloudTrail events from Amazon Elastic File System where an EFS fileshare mount target is deleted. Removing a mount target can disrupt instances and applications that rely on that storage endpoint, making it a high-impact availability event. It relies on CloudTrail telemetry capturing eventSource and eventName for EFS API actions.
references:
  - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: elasticfilesystem.amazonaws.com
    eventName: DeleteMountTarget
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6a7ba45c-63d8-473e-9736-2eaabff79964
    type: derived

What it detects

This rule flags CloudTrail events from Amazon Elastic File System where an EFS fileshare mount target is deleted. Removing a mount target can disrupt instances and applications that rely on that storage endpoint, making it a high-impact availability event. It relies on CloudTrail telemetry capturing eventSource and eventName for EFS API actions.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.