Elastic medium stable kql

AWS EFS File System Deleted

Identifies the deletion of an Amazon EFS file system using the "DeleteFileSystem" API operation. Deleting an EFS file system permanently removes all stored data and cannot be reversed. This action is rare in most environments and typically limited to controlled teardown workflows. Adversaries with sufficient permissions may delete a file system to destroy evidence, disrupt workloads, or impede recovery efforts.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail" 
    and event.provider: "elasticfilesystem.amazonaws.com" 
    and event.action: "DeleteFileSystem" 
    and event.outcome: "success"
    and not user_agent.original: (*Terraform* or *Pulumi*)

False Positives

⚠ Legitimate teardown or environment decommissioning processes may delete EFS file systems. Verify whether the calling user, role, automation system, or CI/CD workflow is expected to perform destructive actions in the affected account. File system deletions by unfamiliar identities, from unusual IP addresses, or occurring outside approved change windows should be carefully reviewed. If known automation routinely deletes ephemeral test file systems, consider adding scoped exceptions.

Field Validations

Loading…

Comments (0)

Loading comments...