afs3-fileserver exploit generally refers to a critical stack-based buffer overflow vulnerability (CVE-2013-1792) found in the OpenAFS fileserver

Monitor for unusual UDP traffic patterns or repeated fileserver crashes, which may indicate exploit attempts.

Traffic attempting to connect to TCP port 7000 on private IP addresses (RFC1918) is often a sign of automated scanning or a misconfigured service attempting to find internal file shares.