This rule detects deletions of EFI bootloader files in the Linux boot directory (/boot/efi/EFI/BOOT/*) with EFI filenames (*.efi*). Deleting or replacing bootloaders in this location can disable the boot manager, bypass Secure Boot, or enable boot-level persistence (bootkits), representing a critical pre-OS tampering risk. The detection uses a Splunk tstats query against the Endpoint.Filesystem data model to identify events where Filesystem.action = "deleted" and the file_path and file_name match the EFI bootloader path pattern. The query returns firstTime/lastTime and contextual fields such as user, dest, and process identifiers to help identify who performed the deletion and on which host. The logic assumes normalized data via the CIM and proper mapping to the Endpoint Filesystem node. The rule maps to MITRE ATT&CK techniques T1542.001 (Boot or Logon Autostart: Pre-OS Boot) and T1542.003 (Bootkit), and is relevant to threats aiming at firmware-level persistence or ransomware. False positives may occur during legitimate maintenance or OS reinstallation; filter by maintenance windows and authorized admin activity. Related references highlight EFI/UEFI security concerns and boot-level threats. Analysts can drill down to view results by user or destination and review a 7-day risk view for correlated risk events. Typical mitigations include limiting access to the EFI partition, enforcing Secure Boot, and signing bootloaders to prevent unauthorized modification.