Impact Analytic Stories

Name Data Sources Tactics Products Date
Windows Defense Evasion Tactics windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 15, Sysmon EventID 1, Sysmon EventID 7, Windows Event Log Security 4688, Windows Event Log System 7040 Credential Access Defense Evasion Discovery Execution Impact Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2024-09-24
MoonPeak windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Windows Event Log Security 4663, Windows Event Log Security 4688 Command And Control Defense Evasion Discovery Execution Impact Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2024-08-21
Handala Wiper windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 23, Sysmon EventID 3, Windows Event Log Security 4688 Defense Evasion Execution Impact Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2024-07-31
Compromised Linux Host linux icon Linux Auditd Add User, Linux Auditd Execve, Linux Auditd Path, Linux Auditd Proctitle, Linux Auditd Service Stop, Linux Auditd Syscall Collection Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2024-06-25
AcidPour linux icon Sysmon EventID 11, Sysmon for Linux EventID 11 Defense Evasion Impact Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2024-04-01
Snake Keylogger windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 15, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 3, Sysmon EventID 5, Sysmon EventID 6, Windows Event Log Security 4663, Windows Event Log Security 4688 Command And Control Credential Access Defense Evasion Discovery Execution Impact Initial Access Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2024-02-12
Splunk Vulnerabilities splunk icon Splunk Stream TCP, Splunk Command And Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation Resource Development Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2024-01-22
CISA AA23-347A windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Suricata, Sysmon EventID 10, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 7, Windows Event Log Security 4663, Windows Event Log Security 4688, Windows Event Log Security 4698, Windows Event Log Security 4699, Windows Event Log Security 4703, Windows Event Log System 7040, Windows Event Log System 7045 Collection Credential Access Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-12-14
Rhysida Ransomware windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 5, Windows Event Log Security 4663, Windows Event Log Security 4688, Windows Event Log System 7045 Credential Access Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-12-12
DarkGate Malware windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 7, Windows Event Log Security 4663, Windows Event Log Security 4688, Windows Event Log Security 4703 Collection Credential Access Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-10-31
PlugX windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 7, Windows Event Log Security 4688, Windows Event Log Security 4703, Windows Event Log System 7045 Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-10-12
NjRAT windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 7, Sysmon EventID 9, Windows Event Log Security 4663, Windows Event Log Security 4688 Command And Control Credential Access Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-09-07
BlackByte Ransomware windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 17, Sysmon EventID 18, Sysmon EventID 1, Sysmon EventID 23, Sysmon EventID 3, Sysmon EventID 5, Sysmon EventID 6, Sysmon EventID 9, Windows Event Log RemoteConnectionManager 1149, Windows Event Log Security 4688, Windows Event Log System 7045, Windows IIS Collection Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-07-10
Graceful Wipe Out Attack windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 17, Sysmon EventID 18, Sysmon EventID 1, Sysmon EventID 3, Sysmon EventID 8, Sysmon EventID 9, Windows Event Log Security 4663, Windows Event Log Security 4688, Windows Event Log Security 5145 Collection Credential Access Defense Evasion Discovery Execution Impact Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-06-15
Volt Typhoon windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Windows Event Log Security 4625, Windows Event Log Security 4648, Windows Event Log Security 4688, Windows Event Log Security 4768, Windows Event Log Security 4771, Windows Event Log Security 4776 Command And Control Credential Access Defense Evasion Discovery Execution Impact Lateral Movement Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-05-25
Data Exfiltration linux icon AWS CloudTrail CreateSnapshot, AWS CloudTrail CreateTask, AWS CloudTrail DeleteSnapshot, AWS CloudTrail GetObject, AWS CloudTrail JobCreated, AWS CloudTrail ModifyImageAttribute, AWS CloudTrail ModifySnapshotAttribute, AWS CloudTrail PutBucketReplication, AWS CloudTrail PutBucketVersioning, CrowdStrike ProcessRollup2, Nginx Access, O365, Powershell Script Block Logging 4104, Splunk Stream HTTP, Sysmon EventID 11, Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688 Collection Command And Control Credential Access Exfiltration Impact Initial Access Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-05-17
Suspicious AWS S3 Activities aws icon AWS CloudTrail CreateTask, AWS CloudTrail PutBucketReplication, AWS CloudTrail PutBucketVersioning, AWS CloudTrail Collection Exfiltration Impact Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-04-24
Data Destruction linux icon CrowdStrike ProcessRollup2, Linux Auditd Execve, Linux Auditd Proctitle, Linux Auditd Service Stop, Powershell Script Block Logging 4104, Sysmon EventID 10, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 23, Sysmon EventID 5, Sysmon EventID 7, Sysmon EventID 9, Sysmon for Linux EventID 11, Sysmon for Linux EventID 1, Windows Event Log Security 4688, Windows Event Log Security 4698, Windows Event Log Security 4769, Windows Event Log Security 5145, Windows Event Log TaskScheduler 200 Command And Control Credential Access Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Reconnaissance Resource Development Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-04-06
Swift Slicer windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 23, Windows Event Log Security 4688 Defense Evasion Impact Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-02-01
AwfulShred linux icon Linux Auditd Execve, Linux Auditd Proctitle, Linux Auditd Service Stop, Sysmon for Linux EventID 11, Sysmon for Linux EventID 1 Defense Evasion Execution Impact Initial Access Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-01-24
LockBit Ransomware windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 17, Sysmon EventID 18, Sysmon EventID 1, Sysmon EventID 5, Sysmon EventID 7, Windows Event Log Security 4688, Windows Event Log System 7036 Defense Evasion Execution Impact Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-01-16
Chaos Ransomware windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Windows Event Log Security 4688 Defense Evasion Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2023-01-11
Prestige Ransomware windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Windows Event Log Security 4688, Windows Event Log Security 4698, Windows Event Log Security 5145, Windows Event Log TaskScheduler 200 Collection Credential Access Defense Evasion Discovery Execution Impact Lateral Movement Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-11-30
Windows Post-Exploitation windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 1, Windows Event Log Security 4688 Collection Credential Access Defense Evasion Discovery Execution Impact Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-11-30
Qakbot windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 10, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 17, Sysmon EventID 18, Sysmon EventID 1, Sysmon EventID 7, Sysmon EventID 8, Windows Event Log Security 4688, Windows Event Log System 7045, Windows Event Log TaskScheduler 200 Command And Control Defense Evasion Discovery Execution Impact Initial Access Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-11-14
CISA AA22-264A windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 10, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 7, Sysmon EventID 9, Windows Event Log Security 1102, Windows Event Log Security 4688 Credential Access Defense Evasion Execution Impact Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-09-22
Brute Ratel C4 windows icon CrowdStrike ProcessRollup2, Sysmon EventID 10, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 7, Sysmon EventID 8, Windows Event Log Security 4688, Windows Event Log Security 4703, Windows Event Log System 7045 Collection Command And Control Credential Access Defense Evasion Execution Impact Initial Access Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-08-23
Linux Living Off The Land linux icon CrowdStrike ProcessRollup2, Linux Auditd Add User, Linux Auditd Execve, Linux Auditd Path, Linux Auditd Proctitle, Linux Auditd Service Stop, Linux Auditd Syscall, Sysmon EventID 1, Sysmon for Linux EventID 11, Sysmon for Linux EventID 1, Windows Event Log Security 4688 Collection Command And Control Credential Access Defense Evasion Discovery Execution Exfiltration Impact Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-07-27
DarkCrystal RAT windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 23, Sysmon EventID 7, Windows Event Log Security 4688, Windows Event Log TaskScheduler 200 Command And Control Defense Evasion Discovery Execution Impact Initial Access Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-07-26
Azorult windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 17, Sysmon EventID 18, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 7, Windows Event Log Security 4663, Windows Event Log Security 4688 Command And Control Credential Access Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-06-09
Industroyer2 linux icon CrowdStrike ProcessRollup2, Linux Auditd Proctitle, Linux Auditd Service Stop, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 5, Sysmon for Linux EventID 11, Sysmon for Linux EventID 1, Windows Event Log Security 4688, Windows Event Log Security 4698, Windows Event Log Security 5145, Windows Event Log TaskScheduler 200 Credential Access Defense Evasion Discovery Execution Impact Lateral Movement Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-04-21
AcidRain linux icon Sysmon for Linux EventID 11 Defense Evasion Impact Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-04-12
Sandworm Tools linux icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 23, Sysmon EventID 7, Sysmon for Linux EventID 1, Windows Event Log Security 4688, Windows Event Log TaskScheduler 200 Credential Access Defense Evasion Discovery Execution Impact Lateral Movement Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-04-05
Caddy Wiper windows icon Sysmon EventID 9 Impact Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-03-25
Windows Registry Abuse windows icon CrowdStrike ProcessRollup2, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Windows Event Log Security 4688 Credential Access Defense Evasion Execution Impact Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-03-17
Hermetic Wiper linux icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 7, Sysmon EventID 9, Sysmon for Linux EventID 1, Windows Event Log Security 4688, Windows Event Log Security 4769, Windows Event Log Security 5145 Command And Control Credential Access Defense Evasion Execution Impact Initial Access Lateral Movement Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-03-02
WhisperGate windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 23, Sysmon EventID 9, Windows Event Log Security 4688 Defense Evasion Discovery Execution Impact Lateral Movement Persistence Privilege Escalation Resource Development Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2022-01-19
Linux Privilege Escalation linux icon Linux Auditd Add User, Linux Auditd Execve, Linux Auditd Path, Linux Auditd Proctitle, Linux Auditd Service Stop, Linux Auditd Syscall, Sysmon for Linux EventID 11, Sysmon for Linux EventID 1 Credential Access Defense Evasion Discovery Execution Exfiltration Impact Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-12-17
Linux Persistence Techniques linux icon Linux Auditd Add User, Linux Auditd Execve, Linux Auditd Path, Linux Auditd Proctitle, Linux Auditd Service Stop, Linux Auditd Syscall, Sysmon for Linux EventID 11, Sysmon for Linux EventID 1 Credential Access Defense Evasion Discovery Execution Exfiltration Impact Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-12-17
FIN7 windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 7, Windows Event Log Security 4663, Windows Event Log Security 4688 Credential Access Defense Evasion Discovery Execution Impact Initial Access Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-09-14
BlackMatter Ransomware windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Windows Event Log Security 4688, Windows Event Log System 7036 Credential Access Discovery Impact Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-09-06
Revil Ransomware windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 7, Windows Event Log Security 4688 Defense Evasion Execution Impact Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-06-04
DarkSide Ransomware windows icon CrowdStrike ProcessRollup2, Powershell Script Block Logging 4104, Sysmon EventID 10, Sysmon EventID 11, Sysmon EventID 17, Sysmon EventID 18, Sysmon EventID 1, Sysmon EventID 7, Windows Event Log Security 4688 Command And Control Credential Access Defense Evasion Execution Exfiltration Impact Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-05-12
XMRig windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 15, Sysmon EventID 1, Sysmon EventID 6, Windows Event Log Security 4688, Windows Event Log Security 4798 Command And Control Credential Access Defense Evasion Discovery Execution Impact Persistence Privilege Escalation Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-05-07
Masquerading - Rename System Utilities windows icon CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 4688 Defense Evasion Impact Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-04-26
Clop Ransomware windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 1, Sysmon EventID 23, Sysmon EventID 5, Windows Event Log Security 1100, Windows Event Log Security 1102, Windows Event Log Security 4688, Windows Event Log System 7045 Defense Evasion Execution Impact Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2021-03-17
Ryuk Ransomware windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Windows Event Log Security 4688, Windows Event Log Security 4698 Defense Evasion Discovery Execution Impact Lateral Movement Persistence Privilege Escalation Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2020-11-06
Ransomware Cloud aws icon AWS CloudTrail CreateKey, AWS CloudTrail PutKeyPolicy, AWS CloudTrail Execution Impact Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2020-10-27
Ransomware windows icon CrowdStrike ProcessRollup2, Palo Alto Network Threat, Palo Alto Network Traffic, Powershell Script Block Logging 4104, Sysmon EventID 11, Sysmon EventID 12, Sysmon EventID 13, Sysmon EventID 1, Sysmon EventID 22, Sysmon EventID 7, Windows Event Log Security 1100, Windows Event Log Security 1102, Windows Event Log Security 4688, Windows Event Log Security 4698, Windows Event Log System 7036 Collection Command And Control Defense Evasion Discovery Execution Exfiltration Impact Initial Access Lateral Movement Persistence Privilege Escalation Reconnaissance Resource Development Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2020-02-04
SamSam Ransomware windows icon CrowdStrike ProcessRollup2, Sysmon EventID 11, Sysmon EventID 1, Windows Event Log Security 4688 Credential Access Defense Evasion Discovery Execution Impact Initial Access Lateral Movement Persistence Reconnaissance Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2018-12-13
Router and Infrastructure Security Collection Credential Access Defense Evasion Exfiltration Impact Initial Access Persistence Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2017-09-12
Windows Log Manipulation windows icon CrowdStrike ProcessRollup2, Sysmon EventID 1, Windows Event Log Security 1100, Windows Event Log Security 1102, Windows Event Log Security 4688 Defense Evasion Impact Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud 2017-09-12