System processes which are suddenly running when they shouldn't be
(such as mounted, when you are not providing NFS services) can be a
sign of unauthorized access.
<p>It can also be the sign of a user wishing to run a process which
they know will not be approved, and naming the program as a system
process in hopes of disguising it from administrative view.