Suspicious AWS EFS Fileshare Mount Modified or Deleted (via cloudtrail)

title: Suspicious AWS EFS Fileshare Mount Modified or Deleted (via cloudtrail)
id: 3e667688-83c4-5319-9e44-543b9fa0517a
status: stable
description: This rule detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
references:
    - https://attack.mitre.org/techniques/T1485/
    - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
author: Huntrule Team
date: 2026-05-24
tags:
    - attack.impact
    - attack.t1485
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: elasticfilesystem.amazonaws.com
        eventName: DeleteMountTarget
    condition: selection
falsepositives:
    - Unknown
level: medium