AWS EFS Fileshare Mount Modified or Deleted — Sigma Rule

Rule metadata and linked tags

Author: Austin Songer @austinsonger. Source status: test; severity: medium. Source dates: 2021-08-15 / 2022-10-09.

{
  "product": "aws",
  "service": "cloudtrail"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: ee799695295c2361326d555336a4f95121997e51f3d6714da3ce5671bf8036be

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: AWS EFS Fileshare Mount Modified or Deleted
id: 6a7ba45c-63d8-473e-9736-2eaabff79964
status: test
description: Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
references:
    - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
author: Austin Songer @austinsonger
date: 2021-08-15
modified: 2022-10-09
tags:
    - attack.impact
    - attack.t1485
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: elasticfilesystem.amazonaws.com
        eventName: DeleteMountTarget
    condition: selection
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html