AWS EFS DeleteFileSystem Events for Fileshare Modification or Deletion

Alert on AWS EFS file system deletion activity observed in CloudTrail via DeleteFileSystem events.

FreeUnreviewedSigmamediumv1

aws-efs-deletefilesystem-events-for-fileshare-modification-or-deletion-25cb1ba1

title: AWS EFS DeleteFileSystem Events for Fileshare Modification or Deletion
id: 44509b00-3829-4523-b404-6a6ef43e3a1e
status: test
description: This rule flags AWS CloudTrail events where an Elastic File System (EFS) file system is deleted (DeleteFileSystem). Deleting an EFS file system disrupts availability and can serve as impact following other actions such as removal of mount targets. The detection relies on CloudTrail telemetry capturing the EFS API eventSource and eventName.
references:
  - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: elasticfilesystem.amazonaws.com
    eventName: DeleteFileSystem
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 25cb1ba1-8a19-4a23-a198-d252664c8cef
    type: derived

What it detects

This rule flags AWS CloudTrail events where an Elastic File System (EFS) file system is deleted (DeleteFileSystem). Deleting an EFS file system disrupts availability and can serve as impact following other actions such as removal of mount targets. The detection relies on CloudTrail telemetry capturing the EFS API eventSource and eventName.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.