AWS EFS Fileshare Mount Modified or Deleted

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1485` Data Destruction

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteMountTarget`: Deletes an EFS mount target, which terminates network connectivity for the associated file system in that subnet.

Rule body

title: AWS EFS Fileshare Mount Modified or Deleted
id: 6a7ba45c-63d8-473e-9736-2eaabff79964
status: test
description: Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
references:
    - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
author: Austin Songer @austinsonger
date: 2021-08-15
modified: 2022-10-09
tags:
    - attack.impact
    - attack.t1485
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: elasticfilesystem.amazonaws.com
        eventName: DeleteMountTarget
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: elasticfilesystem.amazonaws.com
    eventName: DeleteMountTarget

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DeleteMountTarget`	`field:"aws::eventName" kind:eq value:"DeleteMountTarget"`
`eventSource`	eq	`elasticfilesystem.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"elasticfilesystem.amazonaws.com"`