Potential NFS Destructive Operation Burst

Last updated 4 days ago on 2026-07-31

Created 4 days ago on 2026-07-31

About

Identifies a burst of successful NFS write activity combined with destructive REMOVE or RENAME operations from a single client to one export server within a one-minute window. Ransomware and destructive actors often encrypt, delete, or rename large numbers of files on mounted NFS shares; this aggregation surfaces that behavior using NFS opcode telemetry when file paths are not available on the wire.

Tags

Domain: NetworkUse Case: Threat DetectionUse Case: Network Security MonitoringTactic: ImpactData Source: Network Packet CaptureLanguage: esql

Severity

medium

Risk Score

MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Data Encrypted for Impact (T1486)(external, opens in a new tab or window)

False Positive Examples

Backup deduplication engines, migration utilities, and filesystem sync tools can generate high volumes of legitimate NFS writes. Validate the source against known backup or storage-management hosts before escalating.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-network_traffic.nfs-*, packetbeat-* metadata _source
| eval
    Esql.opcode = TO_UPPER(COALESCE(
        JSON_EXTRACT(_source, "network_traffic.nfs.opcode"),
        JSON_EXTRACT(_source, "nfs.opcode")
    )),
    Esql.status = TO_UPPER(COALESCE(
        JSON_EXTRACT(_source, "network_traffic.nfs.status"),
        JSON_EXTRACT(_source, "nfs.status")
    ))
| where Esql.opcode in ("WRITE", "REMOVE", "RENAME") and Esql.status == "NFS_OK" and
    source.ip is not null and destination.ip is not null
| eval Esql.time_window = DATE_TRUNC(1 minutes, @timestamp)
| eval Esql.is_write = CASE(Esql.opcode == "WRITE", 1, 0),
    Esql.is_destructive = CASE(Esql.opcode == "REMOVE" or Esql.opcode == "RENAME", 1, 0)
| stats
    Esql.mutating_ops = COUNT(*),
    Esql.write_ops = SUM(Esql.is_write),
    Esql.destructive_ops = SUM(Esql.is_destructive),
    Esql.values_opcodes = VALUES(Esql.opcode)
  by Esql.time_window, source.ip, destination.ip
| where Esql.mutating_ops >= 100 and Esql.write_ops > 0 and Esql.destructive_ops >= 20
| keep source.ip, destination.ip, Esql.*

Install detection rules in Elastic Security

Detect Potential NFS Destructive Operation Burst in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).