LoFP / legitimate nfs root squashing misconfiguration, administrative automation, or backup appliances may present uid 0 from known infrastructure. confirm the source ip against approved nfs client inventories before closing.

Techniques

• T1039
• T1213

Sample rules

First Time Seen NFS AUTH_SYS Root UID Access

• source: elastic
• technicques:
  • T1039
  • T1213

Description

Identifies the first source and destination IP pair observed in a five-day history window where an NFS client asserts AUTH_SYS (RPC UNIX) credentials with UID 0 (root). NFSv3 and NFSv4 clients can claim arbitrary UIDs through AUTH_SYS, and weak export controls may honor root-equivalent access from unexpected hosts. This is a common precursor to unauthorized mounts, sensitive file reads, and remote encryption of exported shares.

Detection logic

data_stream.dataset:network_traffic.nfs and
network_traffic.nfs.rpc.cred.uid:0 and
network_traffic.nfs.rpc.auth_flavor:unix and
source.ip:* and destination.ip:*