Splunk rules: 3d

id: '25757.47718'
title: Advanced Port Scanner Execution
description: Advanced Port Scanner is a free network scanner that allows users to
  quickly find open ports on network computers and retrieve versions of programs running
  on the ports it detects. Threat actors using Rhysida ransomware have been reported
  to use Advanced Port Scanner during reconnaissance activities.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  ) "advanced_port_scanner.exe" | where match(process_name, "(?i)advanced_port_scanner\.exe")
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- discovery:network service discovery
technique_id: 
- T1046
data_category:
- Windows Sysmon
references:
- https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/rhysida-ransomware-intrusion.pdf?utm_source=blog&utm_medium=blog&utm_campaign=rhysida-ransomware
- https://www.advanced-port-scanner.com/

id: '13733.20159'
title: AnyDesk Command Line Execution
description: 'For most users, normal AnyDesk activity is executed via the GUI. This
  use case detects anydesk.exe calls from cmd.exe or PowerShell.exe. Install commands
  have been filtered out by default. - Threat Actor Association: Alloy Taurus/Gallium,
  Gamaredon (aka. Armageddon, UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus,
  UNC3944), Scatter Swine, UNC2659 - Software Association: Akira, ALPHV/BlackCat,
  AvosLocker, BianLian, BlackByte, BumbleBee, Clop, Conti, Diavol, Rhysida, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) TERM(AnyDesk) (TERM(cmd) OR TERM(powershell))
  | regex process!="(?i)(install)"| where match(process, "(?i)anydesk.exe") | table
  _time, host, user, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html

name: ASL AWS IAM Successful Group Deletion
id: 1bbe54f1-93d7-4764-8a01-ddaa12ece7ac
version: 10
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Hunting
description: The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. This action, while not inherently malicious, can serve as a precursor to more sinister activities, such as unauthorized access or privilege escalation attempts. By monitoring for such deletions, the analytic aids in identifying potential preparatory steps towards an attack, allowing for early detection and mitigation. The identification of this behavior is crucial for a SOC to prevent the potential impact of an attack, which could include unauthorized access to sensitive resources or disruption of AWS environment operations.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=DeleteGroup status=Success
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_iam_successful_group_deletion_filter`
how_to_implement: You must install the Data Lake Federated Analytics App and ingest the logs into Splunk.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
references:
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1069.003
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: AWS Successful Single-Factor Authentication
id: a520b1fe-cc9e-4f56-b762-18354594c52f
version: 11
creation_date: '2022-10-04'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies a successful Console Login authentication event for an AWS IAM user account without Multi-Factor Authentication (MFA) enabled. It leverages AWS CloudTrail logs to detect instances where MFA was not used during login. This activity is significant as it may indicate a misconfiguration, policy violation, or potential account takeover attempt. If confirmed malicious, an attacker could gain unauthorized access to the AWS environment, potentially leading to data exfiltration, resource manipulation, or further privilege escalation.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName= ConsoleLogin errorCode=success "additionalEventData.MFAUsed"=No
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_successful_single_factor_authentication_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: It is possible that some accounts do not have MFA enabled for the AWS account however its agaisnt the best practices of securing AWS.
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://attack.mitre.org/techniques/T1078/004/
    - https://aws.amazon.com/what-is/mfa/
finding:
    title: User $user$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
asset_type: AWS Account
mitre_attack_id:
    - T1078.004
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure AD Application Administrator Role Assigned
id: eac4de87-7a56-4538-a21b-277897af6d8d
version: 15
creation_date: '2023-04-25'
modification_date: '2026-05-13'
author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic identifies the assignment of the Application Administrator role to an Azure AD user. It leverages Azure Active Directory events, specifically monitoring the "Add member to role" operation. This activity is significant because users in this role can manage all aspects of enterprise applications, including credentials, which can be used to impersonate application identities. If confirmed malicious, an attacker could escalate privileges, manage application settings, and potentially access sensitive resources by impersonating application identities, posing a significant security risk to the Azure AD tenant.
data_source:
    - Azure Active Directory Add member to role
search: |-
    `azure_monitor_aad`  operationName="Add member to role"  "properties.targetResources{}.modifiedProperties{}.newValue"="*Application Administrator*"
      | rename properties.* as *
      | rename initiatedBy.user.userPrincipalName as initiatedBy, userAgent as user_agent
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest user src
           vendor_account vendor_product initiatedBy
           user_agent signature
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_ad_application_administrator_role_assigned_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the Auditlog log category
known_false_positives: Administrators may legitimately assign the Application Administrator role to a user. Filter as needed.
references:
    - https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/
    - https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
    - https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roles
    - https://attack.mitre.org/techniques/T1098/003/
    - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator
finding:
    title: The privileged Azure AD role Application Administrator was assigned for User $user$ initiated by $initiatedBy$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Privilege Escalation
    - Scattered Lapsus$ Hunters
asset_type: Azure Active Directory
mitre_attack_id:
    - T1098.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: endpoint

name: Azure AD High Number Of Failed Authentications For User
id: 630b1694-210a-48ee-a450-6f79e7679f2c
version: 13
creation_date: '2023-01-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic identifies an Azure AD account experiencing more than 20 failed authentication attempts within a 10-minute window. This detection leverages Azure SignInLogs data, specifically monitoring for error code 50126 and unsuccessful authentication attempts. This behavior is significant as it may indicate a brute force attack targeting the account. If confirmed malicious, an attacker could potentially gain unauthorized access, leading to data breaches or further exploitation within the environment. Security teams should adjust the threshold based on their specific environment to reduce false positives.
data_source:
    - Azure Active Directory
search: |
    `azure_monitor_aad`
    category=SignInLogs
    properties.status.errorCode=50126
    properties.authenticationDetails{}.succeeded=false
    | rename properties.* as *
    | bin span=10m _time
    | fillnull value=null
    | stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest values(src) as src values(user_agent) as user_agent by user _time vendor_account vendor_product
    | where count > 20
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `azure_ad_high_number_of_failed_authentications_for_user_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment through an EventHub. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the SignInLogs log category.
known_false_positives: A user with more than 20 failed authentication attempts in the span of 10 minutes may also be triggered by a broken application.
references:
    - https://attack.mitre.org/techniques/T1110/
    - https://attack.mitre.org/techniques/T1110/001/
finding:
    title: User $user$ failed to authenticate more than 20 times in the span of 10 minutes.
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Compromised User Account
    - Azure Active Directory Account Takeover
asset_type: Azure Tenant
mitre_attack_id:
    - T1110.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: Cisco Secure Firewall - Lumma Stealer Activity
id: 96bce783-c22e-4e48-8cf1-3eb2794c5083
version: 7
creation_date: '2025-04-16'
modification_date: '2026-05-13'
author: Nasreddine Bencherchali, Splunk, Talos NTDR
status: production
type: TTP
description: |
    This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events.
    It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where four of the following Snort signature IDs 64793, 64794, 64797, 64798, 64799, 64800, 64801, 62709, 64167, 64168, 64169, 64796, 62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64812, 64810, 64811 occurs in the span of 15 minutes from the same host.
    If confirmed malicious, this behavior is highly indicative of a successful infection of Lumma Stealer.
data_source:
    - Cisco Secure Firewall Threat Defense Intrusion Event
search: |
    `cisco_secure_firewall` EventType=IntrusionEvent signature_id IN (64793, 64794, 64797, 64798, 64799, 64800, 64801, 62709, 64167, 64168, 64169, 64796, 62710, 62711, 62712, 62713, 62714, 62715, 62716, 62717, 64812, 64810, 64811)
    | bin _time span=15m
    | fillnull
    | stats dc(signature_id) as unique_signature_count
            values(signature_id) as signature_id
            values(signature) as signature
            values(class_desc) as class_desc
            values(MitreAttackGroups) as MitreAttackGroups
            values(InlineResult) as InlineResult
            values(InlineResultReason) as InlineResultReason
            values(dest) as dest
            values(dest_port) as dest_port
            values(rule) as rule
            values(transport) as transport
            values(app) as app
            min(_time) as firstTime
            max(_time) as lastTime
            by src
    | where unique_signature_count >= 3
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `cisco_secure_firewall___lumma_stealer_activity_filter`
how_to_implement: |
    This search requires Cisco Secure Firewall Threat Defense Logs, which
    includes the IntrusionEvent EventType. This search uses an input macro named `cisco_secure_firewall`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition
    with configurations for your Splunk environment. The search also uses a post-filter
    macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Security Cloud (https://splunkbase.splunk.com/app/7404).
    The intrusion access policy must also be configured.
known_false_positives: False positives should be very unlikely.
references:
    - https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
finding:
    title: Lumma Stealer Activity on host $dest$ origniating from $src$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: signature
      type: signature
    - field: src
      type: ip_address
analytic_story:
    - Cisco Secure Firewall Threat Defense Analytics
    - Lumma Stealer
asset_type: Network
mitre_attack_id:
    - T1190
    - T1210
    - T1027
    - T1204
product:
    - Splunk Enterprise
    - Splunk Cloud
    - Splunk Enterprise Security
category: network
security_domain: network

id: '32258.57437'
title: ComputerDefaults UAC Bypass
description: 'computerdefaults.exe is a legitimate Windows executable handling the
  Default Programs feature in Windows. This feature allows users to set default programs
  for specific tasks such as web browsing, email, and media playback. Threat actors
  may modify the registry to have computerdefaults.exe run arbitrary commands when
  executed, potentially leading to UAC bypass. This use case detects modifications
  to the registry key HKCU\Software\Classes\ms-settings\shell\open\command which is
  associated with computerdefaults.exe. Atomics T1548.002 Test #5 Living Off the Land
  Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=12) OR "<EventID>12<"
  OR TERM(EventCode=13) OR "<EventID>13<") OR ((TERM(EventCode=1) OR "<EventID>1<")
  "ADD" OR "Set-ItemProperty" OR "sp " OR "New-Item" OR "New-ItemProperty" OR "ni")
  "\\software\\classes\\ms-settings\\shell\\open\\command" "DelegateExecute" | table
  _time, host, user ObjectName, process, process_*, parent_process_name | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md

name: Detect HTML Help URL in Command Line
id: 8c5835b9-39d9-438b-817c-95f14c69a31e
version: 17
creation_date: '2021-02-11'
modification_date: '2026-07-14'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of hh.exe (HTML Help) loading a Compiled HTML Help (CHM) file from a remote URL. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing URLs. This activity is significant as it can indicate an attempt to execute malicious scripts via CHM files, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to run scripts using engines like JScript or VBScript, leading to further system compromise or data exfiltration.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
    - Cisco Network Visibility Module Flow Data
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_hh` Processes.process=*http*
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_html_help_url_in_command_line_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1218/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
    - https://lolbas-project.github.io/lolbas/Binaries/Hh/
    - https://blog.sevagas.com/?Hacking-around-HTA-files
    - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
    - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
    - field: process_name
      type: process_name
analytic_story:
    - APT37 Rustonotto and FadeStealer
    - Suspicious Compiled HTML Activity
    - Living Off The Land
    - Compromised Windows Host
    - Cisco Network Visibility Module Analytics
asset_type: Endpoint
mitre_attack_id:
    - T1218.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Exchange PowerShell Module Usage
id: 2d10095e-05ae-11ec-8fdf-acde48001122
version: 17
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. It leverages PowerShell Script Block Logging (EventCode 4104) to identify these commands. This activity is significant because these modules can be exploited by adversaries who have gained access via ProxyShell or ProxyNotShell vulnerabilities. If confirmed malicious, attackers could export mailbox contents, assign management roles, conduct mailbox searches, or view recipient objects, potentially leading to data exfiltration, privilege escalation, or unauthorized access to sensitive information.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*", "*New-MailboxSearch*", "*Get-Recipient*", "Search-Mailbox")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `exchange_powershell_module_usage_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
references:
    - https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
    - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
    - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
    - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
    - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
    - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
    - https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
    - https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
    - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
finding:
    title: Suspicious Exchange PowerShell module usaged was identified on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ProxyNotShell
    - CISA AA22-277A
    - ProxyShell
    - BlackByte Ransomware
    - CISA AA22-264A
    - Scattered Spider
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Exploit Public Facing Application via Apache Commons Text
id: 19a481e0-c97c-4d14-b1db-75a708eb592e
version: 11
creation_date: '2022-10-26'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects attempts to exploit the CVE-2022-42889 vulnerability in the Apache Commons Text Library, known as Text4Shell. It leverages the Web datamodel to identify suspicious HTTP requests containing specific lookup keys (url, dns, script) that can lead to Remote Code Execution (RCE). This activity is significant as it targets a critical vulnerability that can allow attackers to execute arbitrary code on the server. If confirmed malicious, this could lead to full system compromise, data exfiltration, or further lateral movement within the network.
data_source:
    - Nginx Access
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
      WHERE Web.http_method IN (POST, GET)
      BY Web.src Web.status Web.uri_path
         Web.dest Web.http_method Web.uri_query
         Web.http_user_agent
    | `drop_dm_object_name("Web")`
    | eval utf=if(like(lower(uri_query),"%:utf-8:http%"),2,0)
    | eval lookup = if(like(lower(uri_query), "%url%") OR like(lower(uri_query), "%dns%") OR like(lower(uri_query), "%script%"),2,0)
    | eval other_lookups = if(like(lower(uri_query), "%env%") OR like(lower(uri_query), "%file%") OR like(lower(uri_query), "%getRuntime%") OR like(lower(uri_query), "%java%") OR like(lower(uri_query), "%localhost%") OR like(lower(uri_query), "%properties%") OR like(lower(uri_query), "%resource%") OR like(lower(uri_query), "%sys%") OR like(lower(uri_query), "%xml%") OR like(lower(uri_query), "%base%"),1,0)
    | addtotals fieldname=Score utf lookup other_lookups
    | fields Score, src, dest, status, uri_query, uri_path, http_method, http_user_agent firstTime lastTime
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where Score >= 3
    | `exploit_public_facing_application_via_apache_commons_text_filter`
how_to_implement: To implement, one must be collecting network traffic that is normalized in CIM and able to be queried via the Web datamodel. Or, take the chunks out needed and tie to a specific network source type to hunt in. Tune as needed, or remove the other_lookups statement.
known_false_positives: False positives are present when the values are set to 1 for utf and lookup. It's possible to raise this to TTP (direct finding) if removal of other_lookups occur and Score is raised to 2 (down from 4).
references:
    - https://sysdig.com/blog/cve-2022-42889-text4shell/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-42889
    - https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
    - https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/
    - https://github.com/kljunowsky/CVE-2022-42889-text4shell
    - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A URL was requested related to Text4Shell on $dest$ by $src$.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Text4Shell CVE-2022-42889
asset_type: Web Server
cve:
    - CVE-2022-42889
mitre_attack_id:
    - T1133
    - T1190
    - T1505.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Ngrok Reverse Proxy on Network
id: 5790a766-53b8-40d3-a696-3547b978fcf0
version: 10
creation_date: '2022-11-16'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects DNS queries to common Ngrok domains, indicating potential use of the Ngrok reverse proxy tool. It leverages the Network Resolution datamodel to identify queries to domains such as "*.ngrok.com" and "*.ngrok.io". While Ngrok usage is not inherently malicious, it has been increasingly adopted by adversaries for covert communication and data exfiltration. If confirmed malicious, this activity could allow attackers to bypass network defenses, establish persistent connections, and exfiltrate sensitive data, posing a significant threat to the network's security.
data_source:
    - Sysmon EventID 22
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Network_Resolution
      WHERE DNS.query IN ("*.ngrok.com","*.ngrok.io", "ngrok.*.tunnel.com", "korgn.*.lennut.com")
      BY DNS.answer DNS.answer_count DNS.query
         DNS.query_count DNS.reply_code_id DNS.src
         DNS.vendor_product
    | `drop_dm_object_name("DNS")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `ngrok_reverse_proxy_on_network_filter`
how_to_implement: The Network Resolution Datamodel will need to have data mapped to it regarding DNS queries. Modify query as needed to use another source.
known_false_positives: False positives will be present based on organizations that allow the use of Ngrok. Filter or monitor as needed.
references:
    - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: An endpoint, $src$, is beaconing out to the reverse proxy service of Ngrok.
analytic_story:
    - Reverse Network Proxy
    - CISA AA22-320A
    - CISA AA24-241A
asset_type: Endpoint
mitre_attack_id:
    - T1572
    - T1090
    - T1102
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Non Chrome Process Accessing Chrome Default Dir
id: 81263de4-160a-11ec-944f-acde48001122
version: 21
creation_date: '2021-09-15'
modification_date: '2026-08-14'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN ("*\\chrome.exe", "*\\explorer.exe", "*sql*", "*\\dllhost.exe")) ObjectName="*\\Google\\Chrome\\User Data\\Default*" | stats count min(_time) as firstTime max(_time) as lastTime by ObjectName ObjectType ProcessName AccessMask EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: other browser not listed related to chrome may catch by this rule.
references: []
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a non chrome browser process $ProcessName$ accessing $ObjectName$
analytic_story:
    - StealC Stealer
    - CISA AA23-347A
    - Phemedrone Stealer
    - DarkGate Malware
    - NjRAT
    - Malicious Inno Setup Loader
    - Salt Typhoon
    - Remcos
    - Warzone RAT
    - Quasar RAT
    - 3CX Supply Chain Attack
    - AgentTesla
    - FIN7
    - SnappyBee
    - RedLine Stealer
    - Snake Keylogger
    - China-Nexus Threat Activity
    - Lokibot
    - BlankGrabber Stealer
    - VIP Keylogger
    - Salat Stealer
    - Phantom Stealer
    - Vidar Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1555.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: O365 Privileged Graph API Permission Assigned
id: 868f3131-d5e1-4bf1-af5b-9b0fbaaaedbb
version: 9
creation_date: '2024-02-14'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the assignment of critical Graph API permissions in Azure AD using the O365 Unified Audit Log. It focuses on permissions such as Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. The detection method leverages Azure Active Directory workload events, specifically 'Update application' operations. This activity is significant as these permissions provide extensive control over Azure AD settings, posing a high risk if misused. If confirmed malicious, this could allow unauthorized modifications, leading to potential data breaches or privilege escalation. Immediate investigation is crucial.
data_source:
    - O365 Update application.
search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update application.\" | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user src object user_agent signature vendor_account vendor_product dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_graph_api_permission_assigned_filter`"
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: Privileged Graph API permissions may be assigned for legitimate purposes. Filter as needed.
references:
    - https://cloudbrothers.info/en/azure-attack-paths/
    - https://github.com/mandiant/Mandiant-Azure-AD-Investigator/blob/master/MandiantAzureADInvestigator.json
    - https://learn.microsoft.com/en-us/graph/permissions-reference
    - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
    - https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48
finding:
    title: User $user$ assigned privileged Graph API permissions to $object$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Office 365 Persistence Mechanisms
    - NOBELIUM Group
asset_type: O365 Tenant
mitre_attack_id:
    - T1003.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: identity

name: O365 Threat Intelligence Suspicious File Detected
id: 00958c7b-35db-4e7a-ad13-31550a7a7c64
version: 12
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when a malicious file is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Workload=ThreatIntelligence Operation=AtpDetection
      | eval dest="NA"
      | eval src="NA"
      | stats values(DetectionMethod) as category values(FileData.FileName) as file_name values(FileData.FilePath) as file_path values(FileData.FileSize) as file_size values(FileData.MalwareFamily) as signature count, min(_time) as firstTime, max(_time) as lastTime
        BY Id, UserId, dest,
           src, vendor_account, vendor_product
      | rename Id as signature_id, UserId as user
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_threat_intelligence_suspicious_file_detected_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. The threat intelligence workload is typically only visible to E3/E5 level customers.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-real-time-detections-about?view=o365-worldwide
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide
finding:
    title: Threat Intelligence workload detected a malicious file [$file_name$] from user $user$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Azure Active Directory Account Takeover
    - Office 365 Account Takeover
    - Ransomware Cloud
asset_type: O365 Tenant
mitre_attack_id:
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '31190.55838'
title: PromptOnSecureDesktop Registry Value Modified
description: 'Adversaries may bypass UAC mechanisms to elevate process privileges
  on system. Windows User Account Control (UAC) allows a program to elevate its privileges
  (tracked as integrity levels ranging from low to high) to perform a task under administrator-level
  permissions, possibly by prompting the user for confirmation. The impact to the
  user ranges from denying the operation under high enforcement to allowing the user
  to perform the action if they are in the local administrators group and click through
  the prompt or allowing them to enter an administrator password to complete the action.
  This use case detects registry modification events or process executions with registry
  modification commands targeting \Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop.
  -- Software Association: 8Base'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ("Set-Item-Property"
  OR "sp " OR "ADD") "PromptOnSecureDesktop" "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  | table _time, host, user, process | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- privilege-escalation:abuse elevation control mechanism:bypass user account control
technique_id:
- T1548.002
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1548/002/
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-8base?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=0424_8base
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md

name: Risk Rule for Dev Sec Ops by Repository
id: 161bc0ca-4651-4c13-9c27-27770660cf67
version: 12
creation_date: '2023-11-16'
modification_date: '2026-05-13'
author: Bhavin Patel
status: production
type: Correlation
description: The following analytic identifies high-risk activities within repositories by correlating repository data with risk scores. It leverages findings and intermediate findings created by detections from the Dev Sec Ops analytic stories, summing risk scores and capturing source and user information. The detection focuses on high-risk scores above 100 and sources with more than three occurrences. This activity is significant as it highlights repositories frequently targeted by threats, providing insights into potential vulnerabilities. If confirmed malicious, attackers could exploit these repositories, leading to data breaches or infrastructure compromise.
data_source: []
search: |-
    | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as sum_risk_score, values(All_Risk.annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
      WHERE All_Risk.analyticstories="Dev Sec Ops" All_Risk.risk_object_type = "other"
      BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
    | `drop_dm_object_name(All_Risk)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | where source_count > 3 and sum_risk_score > 100
    | `risk_rule_for_dev_sec_ops_by_repository_filter`
how_to_implement: Ensure that all relevant detections in the Dev Sec Ops analytic stories are enabled and are configured to create findings or intermediate findings in Enterprise Security.
known_false_positives: No false positives have been identified at this time.
references: []
finding:
    title: Risk Threshold Exceeded for $risk_object$
    entity:
        field: risk_object
        type: other
        score: 0
analytic_story:
    - Dev Sec Ops
asset_type: Amazon Elastic Container Registry
mitre_attack_id:
    - T1204.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Rubeus Kerberos Ticket Exports Through Winlogon Access
id: 5ed8c50a-8869-11ec-876f-acde48001122
version: 14
creation_date: '2022-02-07'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk.
data_source:
    - Sysmon EventID 10
search: '`sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff) (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe AND SourceImage!=C:\\Windows\\system32\\wbem\\wmiprvse.exe) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment.
known_false_positives: Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
references:
    - https://github.com/GhostPack/Rubeus
    - https://web.archive.org/web/20210725005734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
    - https://attack.mitre.org/techniques/T1550/003/
finding:
    title: Winlogon.exe was accessed by $SourceImage$ on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: TargetImage
      type: process
analytic_story:
    - CISA AA23-347A
    - Active Directory Kerberos Attacks
    - BlackSuit Ransomware
    - Scattered Lapsus$ Hunters
    - ZOVWiper
asset_type: Endpoint
mitre_attack_id:
    - T1550.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Sunburst Correlation DLL and Network Event
id: 701a8740-e8db-40df-9190-5516d3819787
version: 11
creation_date: '2020-12-14'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: experimental
type: TTP
description: The following analytic identifies the loading of the malicious SolarWinds.Orion.Core.BusinessLayer.dll by SolarWinds.BusinessLayerHost.exe and subsequent DNS queries to avsvmcloud.com. It uses Sysmon EventID 7 for DLL loading and Event ID 22 for DNS queries, correlating these events within a 12-14 day period. This activity is significant as it indicates potential Sunburst malware infection, a known supply chain attack. If confirmed malicious, this could lead to unauthorized network access, data exfiltration, and further compromise of the affected systems.
data_source:
    - Sysmon EventID 7
    - Sysmon EventID 22
search: |-
    `sysmon`
    (
        EventCode=7
        ImageLoaded=*SolarWinds.Orion.Core.BusinessLayer.dll
    )
    OR
    (
        EventCode=22
        QueryName=*avsvmcloud.com
    )
    | eventstats dc(EventCode) AS dc_events
    | where dc_events=2
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
        by Image ImageLoaded dest
           loaded_file loaded_file_path original_file_name
           process_exec process_guid process_hash
           process_id process_name process_path
           service_dll_signature_exists service_dll_signature_verified signature
           signature_id user_id vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `sunburst_correlation_dll_and_network_event_filter`
how_to_implement: This detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mandiant.com/resources/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor
finding:
    title: Possible Sunburst activity on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - NOBELIUM Group
asset_type: Windows
mitre_attack_id:
    - T1203
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5526.5752'
title: Utility Archive Data
description: 'An adversary may compress or encrypt data that is collected prior to
  exfiltration using 3rd party utilities. Many utilities exist that can archive data,
  including 7-Zip, WinRAR, and WinZip. Most utilities include functionality to encrypt
  and/or compress data. -- Threat Actor Association: APT10/Cicada, APT27/Emissary
  Panda, APT29/Nobelium/Cozy Bear, APT31, DarkSide, BlackMatter, FIN6, FIN7, Harvester,
  Karakurt, Lancyfly, Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), RedEyes, UNC5221, UTA0178. Volt Typhoon - Software Association:
  Akira, AvosLocker, Clop, Conti, GhostShell, Hafnium, LockBit, Play, Quantum, Ransom
  Cartel -- #TrendingThreat #Russia #Ukraine -- Atomics T1560.001 Test#1 Atomics T1560.001
  Test#2 Atomics T1560.001 Test#3 Atomics T1560.001 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(WinRAR.exe)
  OR TERM(WinRAR) OR TERM(rar.exe) OR TERM(rar) OR TERM(7zG.exe) OR TERM(7zG) OR TERM(peazip.exe)
  OR TERM(peazip) OR TERM(powerarc.exe) OR TERM(powerarc) OR TERM(Bandizip.exe) OR
  TERM(Bandizip) OR TERM(Zipware.exe) OR TERM(Zipware) OR TERM(winzip)) | regex process_name="(?i)(winrar|rar|7z*|peazip|powerarc|bandizip|zipware|winzip*)\.exe"|
  table _time, host, user signature_id, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- collection:archive collected data:archive via utility
technique_id:
- T1560.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://askleo.com/why-spammers-love-zip-files-and-how-you-need-to-stay-safe/