DETECTION OVERVIEW
Risk Factors
The complexity is low, but an attacker must have valid permissions to modify files on a shared file server. This technique can help an attacker manipulate data or hide malicious activity, which can then be leveraged in a later attack.
The system might change the risk score for this detection.
Kill Chain
Risk Score
60
After an attacker obtains a valid set of credentials, they can proceed with malicious activity that might be overlooked as normal file change operations sent over the NFS file-sharing protocol. Attackers can compromise data integrity by manipulating, inserting, or deleting files outside of standard operations.