SIGNATURE_BASE_HKTL_NFS_Fuse_NFS

rule SIGNATURE_BASE_HKTL_NFS_Fuse_NFS
{
	meta:
		description = "Detects the nfs-security-tooling fuse_nfs by HvS Consulting"
		author = "Moritz Oettle"
		id = "287fbe7d-ee1c-58a4-aa2d-9d9bec8321b4"
		date = "2024-10-22"
		modified = "2025-03-20"
		reference = "https://github.com/hvs-consulting/nfs-security-tooling"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_HvS_nfs_security_tooling.yar#L1-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "0bd3714b865d77660404e5f3ed1e9c7b55aadc6f58d16761111be57597784686"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s1 = "NFS3ConnectionFactory" fullword ascii
		$s2 = "fuse_to_nfs_timestamp" fullword ascii
		$s3 = "--manual-fh" fullword ascii
		$s4 = "--fake-uid-allow-root" fullword ascii
		$s5 = "nfs.rpc.credential" fullword ascii
		$s6 = "nfs.readlink" fullword ascii
		$s7 = "pyfuse3.EntryAttributes" fullword ascii
		$s8 = "Make nested exports on NetApp servers work" fullword ascii
		$s9 = "add_mutually_exclusive_group" fullword ascii

	condition:
		4 of them
}