First Time Seen NFS AUTH_SYS Root UID Access

Last updated a month ago on 2026-06-25

Created a month ago on 2026-06-25

About

Identifies the first source and destination IP pair observed in a five-day history window where an NFS client asserts AUTH_SYS (RPC UNIX) credentials with UID 0 (root). NFSv3 and NFSv4 clients can claim arbitrary UIDs through AUTH_SYS, and weak export controls may honor root-equivalent access from unexpected hosts. This is a common precursor to unauthorized mounts, sensitive file reads, and remote encryption of exported shares.

Tags

Domain: NetworkUse Case: Threat DetectionUse Case: Network Security MonitoringTactic: CollectionData Source: Network Packet CaptureLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Collection (TA0009)(external, opens in a new tab or window)

↳ Data from Network Shared Drive (T1039)(external, opens in a new tab or window)

↳ Data from Information Repositories (T1213)(external, opens in a new tab or window)

False Positive Examples

Legitimate NFS root squashing misconfiguration, administrative automation, or backup appliances may present UID 0 from known infrastructure. Confirm the source IP against approved NFS client inventories before closing.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-network_traffic.nfs*
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:network_traffic.nfs and
network_traffic.nfs.rpc.cred.uid:0 and
network_traffic.nfs.rpc.auth_flavor:unix and
source.ip:* and destination.ip:*

Install detection rules in Elastic Security

Detect First Time Seen NFS AUTH_SYS Root UID Access in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).