AWS EFS Fileshare Modified or Deleted

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	No specific technique

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteFileSystem`: Permanently deletes an Amazon EFS file system, which must have no mount targets or access points remaining.

Rules detecting the same action

These rules filter on the same operation.

AWS EFS File System Deleted (Elastic)

Rule body

title: AWS EFS Fileshare Modified or Deleted
id: 25cb1ba1-8a19-4a23-a198-d252664c8cef
status: test
description: |
  Detects when a EFS Fileshare is modified or deleted.
  You can't delete a file system that is in use.
  If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.
references:
    - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html
author: Austin Songer @austinsonger
date: 2021-08-15
modified: 2022-10-09
tags:
    - attack.impact
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: elasticfilesystem.amazonaws.com
        eventName: DeleteFileSystem
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: elasticfilesystem.amazonaws.com
    eventName: DeleteFileSystem

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DeleteFileSystem`	`field:"aws::eventName" kind:eq value:"DeleteFileSystem"`
`eventSource`	eq	`elasticfilesystem.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"elasticfilesystem.amazonaws.com"`