Detectionmediumtest

AWS EFS Fileshare Mount Modified or Deleted

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin SongerCreated Sun Aug 15Updated Sun Oct 096a7ba45c-63d8-473e-9736-2eaabff79964cloud

Log Source

AWScloudtrail

ProductAWS← raw: aws

Servicecloudtrail← raw: cloudtrail

Detection Logic

detection:
    selection:
        eventSource: elasticfilesystem.amazonaws.com
        eventName: DeleteMountTarget
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

docs.aws.amazon.com

MITRE ATT&CK

Tactics

TA0040 · Impact

Techniques

T1485 · Data Destruction

Rule Metadata

Rule ID

6a7ba45c-63d8-473e-9736-2eaabff79964

Status

test

Level

medium

Type

Detection

Created

Sun Aug 15

Modified

Sun Oct 09

Author

Austin Songer

Path

rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml

Raw Tags

attack.impactattack.t1485

View on GitHub