SIGNATURE_BASE_HKTL_NFS_NFS_Analyze

rule SIGNATURE_BASE_HKTL_NFS_NFS_Analyze
{
	meta:
		description = "Detects the nfs-security-tooling nfy_analyze by HvS Consulting"
		author = "Marc Stroebel"
		id = "3350d0ae-e638-5c8f-a578-ba0ac5521053"
		date = "2024-10-22"
		modified = "2025-03-20"
		reference = "https://github.com/hvs-consulting/nfs-security-tooling"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_HvS_nfs_security_tooling.yar#L26-L53"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "83a9e5b5b404bf28b0334611fe4f38227212783cecea3c9996d23cb00cad42ed"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s1 = "no_root_squash_exports" fullword ascii
		$s2 = "nfs lock manager" fullword ascii
		$s3 = "netapp partner" fullword ascii
		$s4 = "xdrdef.mnt3_type" fullword ascii
		$s5 = "BTRFS subvolumes" fullword ascii
		$s6 = "Unsupported fsid" fullword ascii
		$s7 = "nfs3_read_etc_shadow" fullword ascii
		$s8 = "nfs3_check_no_root_squash" fullword ascii
		$s9 = "krb5i" fullword ascii
		$s10 = "nfs4_overview" fullword ascii
		$s11 = "--btrfs-subvolumes" fullword ascii
		$s12 = "when escaping a BTRFS export" fullword ascii
		$s13 = "No NFS server detected" fullword ascii

	condition:
		6 of them
}