AWS EFS Filesystem Modified or Deleted via CloudTrail
Alert on AWS EFS file system deletion activity observed in CloudTrail via DeleteFileSystem events.
FreeReviewedSigma · Medium · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-15
- Updated
- 2026-07-31
What it detects
Identifies CloudTrail events where an Amazon EFS file system is deleted. Deletion of an EFS file system is a high-impact action that can disrupt access for applications and workloads. The rule relies on Elastic File System API activity recorded in CloudTrail, matching the elasticfilesystem service and DeleteFileSystem event name.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-efs-deletefilesystem-events-for-fileshare-modification-or-deletion-25cb1ba1
title: AWS EFS Filesystem Modified or Deleted via CloudTrail
id: 44509b00-3829-4523-b404-6a6ef43e3a1e
status: test
description: Identifies CloudTrail events where an Amazon EFS file system is deleted. Deletion of an EFS file system is a high-impact action that can disrupt access for applications and workloads. The rule relies on Elastic File System API activity recorded in CloudTrail, matching the elasticfilesystem service and DeleteFileSystem event name.
references:
- https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-15
modified: 2022-10-09
tags:
- attack.impact
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: elasticfilesystem.amazonaws.com
eventName: DeleteFileSystem
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 25cb1ba1-8a19-4a23-a198-d252664c8cef
type: derived