This rule detects a burst of successful NFS write activity paired with destructive REMOVE or RENAME operations from a single client to a single NFS export within a one-minute window. It uses NFS opcode telemetry exposed by the network_traffic integration, aggregating mutating NFS opcodes because exact file paths are not published on the wire. The ESQL query extracts NFS opcode and status from _source, uppercases them, and filters for WRITE, REMOVE, or RENAME with NFS_OK. It requires non-null source and destination IPs, buckets events into one-minute windows by source/destination IP, and flags whether an operation is a write or destructive. It then computes: mutating_ops, write_ops, destructive_ops, and observed opcodes. An alert fires when mutating_ops >= 100, write_ops > 0, and destructive_ops >= 20 within the window, indicating a potential mass file modification, encryption, or deletion on a mounted NFS share. The rule provides context for triage and investigation, including cross-checking with approved backup or admin hosts, pivoting to endpoint telemetry for ransomware indicators, and verifying exports for ransom-related activity. False positives may arise from backup, synchronization, or VM storage migration; validation during maintenance windows is recommended. Setup requires the Elastic network_traffic integration with the NFS protocol module enabled on a sensor observing the target exports. The rule’s risk_score is 47 and severity is medium. It maps to MITRE ATT&CK techniques T1486 (Data Encrypted for Impact) and T1039 (Aggregate references).