Detects the first observed source-destination IP pair in a rolling five-day window where an NFS client asserts AUTH_SYS (Unix authentication) credentials with UID 0 (root) over RPC. NFSv3/v4 allow arbitrary UIDs with AUTH_SYS, and weak export controls may grant root-equivalent access from non-authorized hosts. The rule monitors network_traffic.nfs data for rpc.cred.uid:0 and rpc.auth_flavor: unix, requiring both a source and destination IP. This combination signals potential unauthorized mounts, sensitive reads, or remote encryption attempts on exported shares. By identifying the first-time root-UID access per host pair within the history window, it helps surface reconnaissance or preparation activity before broader I/O or tampering. False positives can arise from legitimate NFS root squashing misconfigurations, automation, or backup appliances; these should be validated against approved client inventories. The rule is designed to support triage and containment actions around suspicious NFS export access, including auditing export policies and tightening RPC security. MITRE coverage includes T1039 (Data from Network Shared Drive) and T1213 (Data from Information Repositories).