Threat hunting with splunk pdf

It provides detailed processes for different types of hunts, guidance on creating detections and other deliverables, and metrics focused on telling the story of hunting's impact on an organization’s overall security. Step 1 — Reconnaissance. com. On the right side, click the " Last 24 hours " box and click " All time ". This includes information on detected malware, intrusion attempts, and other security-related Organizations rely on threat hunting to identify malicious activity, improve security and mitigate risk. Detecting Trickbot attacks. It outlines an agenda that includes a hands-on walkthrough of an attack scenario using Splunk's core capabilities. Attackers can make users run malicious code or persist on an endpoint by targeting file extensions that users are familiar with. There are several areas in which commercial and industrial partners in the defensive cyber operations community can enable TTP-based hunting, relating to platform development, data generation, interoperability, data analysis, and threat information sharing. a large number of failed logins in a short amount of time). Understand the basic requirements to model threats. Consider our organization’s website is imreallynotbatman. Add a filter block and set the parameter to hunt_file_1 > device_count. Each hunt type follows a three-stage process: Prepare, Execute, and Act. Baseline Hunts. Protect your business and elevate your security operations with a best-in-class data platform, advanced analytics and automated Sep 18, 2023 · The stats command for threat hunting. Mar 19, 2024 · REGISTER NOW. Using tools like Splunk Enterprise Security, Splunk Threat Intelligence Management, and Splunk Intel Management (Legacy), you analyze Sigma is a useful tool for sharing threat detection information, focused on detecting anomalies in log data such as computer processes, commands, and operations associated with malware or malicious tools. Clop ransomware known service name. Using DSDL’s golden image, we can launch JupyterLab and use a notebook to directly train and test a model. Expose cyber criminals as early as possible — before systems and services are compromised. This library contains a list of: Tools, guides, tutorials, instructions, resources, intelligence, detection and correlation rules (use case and threat case for a variety of SIEM platform such as SPLUNK , ELK , By using Splunk SOAR, your business can take inputs, apply workflows, and automate repetitive manual tasks, freeing up analysts to perform the most crucial parts of the investigation and remediation of security events. 1 > René Agüero raguero@splunk. Splunk Enterprise Security administrators can add threat intelligence by downloading a feed from the Internet, uploading a structured file, or inserting the threat intelligence directly from events into your deployment. Oct 24, 2023 · The lab is provided by INE — Effectively Using Splunk (S1). The heat map in the Navigator uses darker blue colors to indicate a higher number of correlation rules aligned Aug 25, 2023 · The six Splunk security use cases are: Security monitoring. Server Message Block (SMB) is a network file sharing and data fabric protocol. security events by providing relevant and normalized intelligence to better understand threat context and accelerate time to triage. Nov 4, 2016 · Threat Hunting with Splunk. Utilizing a novel backdoor variant, WINELOADER, these campaigns leverage diplomatic-themed lures to initiate infection chains, demonstrating APT29’s evolving tactics Aug 19, 2021 · Hunting for Detections in Attack Data with Machine Learning. Monitoring DNS queries. It will also delve into the world of Advanced Persistent Threats (APTs) and offer examples of known APT groups and their Indicators of Compromise (IoCs). Splunk Subject: The Threat Hunter Intelligence Report is a monthly series brought to you by Splunk s threat hunting and intelligence (THI) team. In this in-depth article, we will: Define threat modeling and discuss its benefits and challenges. Nov 2, 2016 · The document discusses a presentation on threat hunting with Splunk. We research and produce actionable reports on the latest cybersecurity threats and trends helping organizations stay one s tep ahead of adversaries, one report at a time. The FIN7 group also uses REvil and Darkside ransomware payloads after gaining access This is a repository to store Splunk code (SPL) and prototypes useful for building rules (correlation searches) and queries to find and hunt for malicious activity. Here's some brand new and forever-favorite resources, too, that are about threat hunting with or without Splunk: Threat Hunting: Everything To Know About Hunting Cyber Threats NEW: PEAK Threat Hunting Framework Series Detecting Windows file extension abuse. Do these steps: In the Search box, type. retail, restaurant, and hospitality sectors since mid-2015. Let’s start with both WinEventLog and Sysmon examples: 1. The PEAK Threat Hunting Framework — a practical, vendor-agnostic, customizable approach to threat hunting, designed to help organizations create or refine their threat hunting programs — takes the experience of top threat hunters and translates their insights to help you gain the most MBSD Automates Security Operations for Faster Threat Hunting and Greater Agility. Our advanced security detections enable better situational awareness and rapid response times to suspicious behavior. Splunk is a data analytics platform that can be used to analyze large volumes of security data from a variety of sources, including security logs, network traffic, and endpoint data. Security analyst teams can be quickly overwhelmed by the number of alerts and incidents being generated in the environment. Added security defenses. The Splunk Threat Research Team is dedicated to empowering security teams with the tools and insights needed to quickly identify and neutralize threats. Ransomware authors can use SMB to trick a target machine into contacting a malicious server running inside a trusted network, or to any server outside of the network. Threat Intelligence Management — a feature of Splunk® Enterprise Security — helps analysts to fully investigate. Scroll down to examine the most recent event. APT29, a sophisticated threat actor linked to the Russian SVR, has expanded its cyber espionage activities to target European diplomats and German political parties. Look at both simple and more advanced frameworks to guide you. It incorporates three distinct types of hunts: Hypothesis-Driven; Baseline (AKA Exploratory Data Analysis or EDA) Model-Assisted Threat Hunts (M-ATH) Advanced Incident Detection and Threat Hunting Using Sysmon 1. 2 Ken Westin kwestin@splunk. May 23, 2017 • Download as PPTX, PDF •. Threat Hunting with Splunk Presenter: Ken Westin, M. You obviously need to be ingesting Sysmon data into Splunk, a good configuration can be found here. Sc, OSCP Splunk, Security Market Specialist Agenda • Threat Huting Basics • Threat Hunting Data Sources • Sysmon… Jan 4, 2024 · The Splunk Threat Research Team’s Approach. Look for lots of brackets { } Look for lots of quotes (single & double) “ “ & ‘ ’. Learn how Splunk SOAR can help security practitioners perform threat hunting activities at machine speed. 2. Some of the detections that can help you with this use case include: Clop common exec parameter. 5 Implications for Industry. Select the “Greater than” condition and set the specified value to 0. See how these common methods blend the different types. It provides an agenda that includes topics like threat hunting basics, data sources for threat hunting, using Sysmon endpoint data, the cyber kill chain framework, and doing an advanced threat hunting walkthrough using Splunk. The Splunk Phantom Recorded Future Threat Hunting playbook uses endpoint detection and response tools to hunt for threat indicators in the environment. sourcetype="stream:http". Incident management. Apps: Splunk, Reversing Labs, Carbon Black Response, Threat Grid, Falcon Host API. Cyber threat hunting digs deep to find ma In the "sourcetype" box, in the "Top 10 Values" list, near the bottom, if it is visible, click stream:http. Threat hunting with Splunk is a powerful way to proactively detect and respond to cyber threats. Let’s start by taking a look at the details found in Sysmon. PEAK, an acronym for "Prepare, Execute, and Act with Knowledge," brings a fresh perspective to threat hunting. S. Detecting recurring malware on a host. On the right side, click the green magnifying-glass icon. 0 • CISSP, MSBA – Information Assurance (forensics, auditing and security) • Offensive Security • Exploitation – Metasploit, Web attacks • Rapid7 SE Director The threat detection capabilities in Behavior Analytics extend the search/pattern/ expression (rule) based approaches currently in Splunk and Splunk ES for detecting threats. Threat intelligence enrichment. It provides an agenda that includes an overview of threat hunting basics and data sources, a demonstration of using Sysmon endpoint data to investigate an attack scenario according to the cyber kill chain framework, and a discussion of applying machine learning and data science to security. The STIX document format exists solely in order to make threat intelligence Aug 23, 2017 · Follow. This MITRE ATT&CK technique, T1505, is used by adversaries to backdoor web servers and establish persistent access to systems. In this article, we’ll walk through a sample hypothesis-driven hunt, step-by-step. This book also serves as a jumping off point for how to get creative with Splunk. Enable PowerShell script block logging. Aug 8, 2023 · STEALTHbits’ Threat Hunting solution enables organizations to target and hunt active cyber threats. com • > 1 year at Splunk – Security Specialist • Based in Manhattan • 18 years in security – MCSE NT4. By Splunk. Model-Assisted Threat Hunts (M-ATH) In this post, we’re going to look at hypothesis-driven hunting in detail. There is not a definitive schedule for these actions, but Aug 2, 2023 · The PEAK threat hunting framework provides a set of key metrics you can use as a starting point for measuring the impact that your hunting program has on your security program. Look at length of PowerShell command. The metadata and connection activity in Splunk gives your security team visibility, rich telemetry and dynamic integrated risk scoring to intelligently monitor and detect threats, and automate Splunk User Behavior Analytics focuses on two main use cases: detecting malicious insiders and identifying advanced cyber attacks happening inside the environment. Advanced threat detection. Some of the detections that can help you with this use case include: Detect new open S3 buckets. Detecting malicious activities with Sigma rules. Nov 5, 2023 · Pan:threat, on the other hand, is used for indexing data related to security threats and incidents. Another very good & free lab: here. This document provides an overview of threat hunting using Splunk. The playbook provides additional actions you can use to obtain more information about the threats and further investigate any malicious files you discover. Jan 30, 2020 · Option 1: Use an overly broad filter to filter out all results containing the string “Legit Monitoring Agent”. With Splunk Threat Intelligence Management, you can detect and enrich incidents by correlating your internal data with external intelligence sources. About Feel free to contribute and share your feedbak in case you find it useful. Look for random function names & many unusual characters not normally in PowerShell scripts. Splunk. It also discusses applying machine learning and If you do not have Splunk Enterprise Security, these detections will still give you an idea of what you can accomplish with SPL in the Splunk platform or with the free app, Splunk Security Essentials. The document outlines a presentation on threat hunting with Splunk. to the search and finds approximately 252 results, as shown below. The search finishes within a few seconds, and Splunk Enterprise Software (“Splunk”) is probably the single most power - ful tool for searching and exploring data that you will ever encounter. Aug 1, 2022 · Threat hunting is the practice of proactively searching for cyber threats that are lurking undetected in a network. Visualizing processes and their parent/child relationships. View Product Details. As a result, organizations can defend against evolving threats more effectively than ever before. Apr 18, 2023 · The PEAK framework, with its unique blend of Hypothesis-Driven, Baseline, and Model-Assisted hunt types, provides a repeatable, flexible, and modern approach to threat hunting. 10 likes • 5,069 views. FIM can help you detect unauthorized changes made to files, directories, network devices, operating systems, and more. FIN7 malware is commonly deployed through spear-phishing campaigns as an entry to the target network or host. Hunting for Normal Within Chaos. Get the report. I'm including queries with regular expressions, so detection will be possible even if you haven't parsed the logs properly. Focusing your hunt. I'll add to this list as I find more. Feb 12, 2024 · Threat modeling is the process of mapping security weaknesses in a system and prioritizing how to respond to them. One of the first steps I need to take is narrowing down this extensive scope of data and time to a more specific range or subset. They effectively combat insider threats, credential access and compromise, lateral movement and living off the land. You already use Sysmon, particularly Event code 1 - process creation, to gain fidelity into programs starting on your systems, but you know there are other Sysmon events that you may want to utilize during your hunts. To identify and mitigate these advanced threats, analysts must become proactive in identifying Sampling the Data. The automated protection achieved with Splunk SOAR allows us to work much more efficiently. Splunk adds. Jan 21, 2021 · Description. com Twitter: @kwestin • Portland native • 20 years in technology and security • ~2 years at Splunk – Security Strategist • Based in Portland, Oregon • Trained in offensive & defensive security Endpoint security. Sep 12, 2023 · With the Splunk App for Data Science and Deep Learning (DSDL), we can directly use Python-native data science libraries and integration with Splunk to assist in our threat hunting. Part of your role involves monitoring events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS The Splunk Security Operation Suite uses purpose-built frameworks and workflows to speed up detection, investigation and incident response. Refining the model can include experimenting with Nov 10, 2023 · The new vendor-agnostic PEAK Threat Hunting Framework from SURGe is designed to foster continuous improvement through hunting. g. As an added bonus, use the app and dataset and apply that learning to future BOTS competitions—you may find golden lights displaying your name! With that, don’t Feb 21, 2023 · Threat hunting is often categorized into three main investigation types: structured, unstructured and ad-hoc. A serious vulnerability ( CVE-2021-44228) in the popular open source Apache Log4j logging library poses a threat to thousands of applications and third-party services that leverage this library, allowing attackers to execute arbitrary code from an external source. Threat Hunting with Splunk Awesome Splunk SPL queries that can be used to detect the latest vulnerability exploitation attempts &, threat hunt for MITRE ATT&CK TTPs. This repository is a library for hunting and detecting cyber threats. Each phase of a hunt also integrates Knowledge, which together make up the PEAK acronym (Prepare, Execute, and Act with Knowledge). SOAR centralizes capabilities such as case and incident management features, threat intelligence management, essential state of Download the webinar recording for a demonstration of technology by security experts from Splunk, and the Johns Hopkins University Applied Physics Lab to learn how you can: Proactively hunt threats to minimize impact to the mission; Ingest and search against unique Government developed threat intelligence and other sources of IOCs Nov 28, 2023 · The eval command for hunting. Learn about the latest threats, trends and cyber-resilience strategies your peers are using to keep their organizations safe. Sigma operates on threat data captured from various sources, while also enabling threat hunters to aggregate events which would otherwise be Splunk. Real-world tutorial: Threat hunting in Sysmon Now let’s go hunting! We’ll walk through an actual tutorial for threat hunting in Sysmon. Type: Investigation. Automation & orchestration. This is a Splunk application containing several dashboards and over 130 reports that will facilitate initial hunting indicators to investigate. Download your copy to learn about: The You can assess coverage and identify defense gaps by mapping your correlation rules against the MITRE ATT&CK framework. ” – Masaru Sekihara, Chief Operating Officer of MBSD Detecting Log4j remote code execution. This list goes on and on. 0 • CISSP, MSBA – Information Assurance (forensics, auditing and security) • Offensive Security • Exploitation – Metasploit, Web attacks • Rapid7 SE Director Splunk Jan 30, 2020 · Get insights. Apr 25, 2024 · Step 2. Combined with threat intelligence, hunting enables organizations to: Better understand the attack surface. The stats command is a fundamental Splunk command. The hunting Playbook queries a number of internal security technologies in order to determine if any of the artifacts present in your data source have been observed in your environment. As a (fairly) new member of Splunk’s Threat Research team (STRT), I found a unique opportunity to train machine learning models in a more impactful way. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred. It will perform any number of statistical functions on a field, which could be as simple as a count or average, or something more advanced like a percentile or standard deviation. Threat Hunting resources. It also uses pre-built dashboards, reports, investigation capabilities, use case categories, analytics, correlation searches and security indicators to simplify threat management and incident management. This can be accomplished by establishing a “baseline” for a file state and monitoring for changes made to that state. Using the preconfigured STEALTHbits Threat Hunting App for Splunk, users can quickly understand all Threat Hunting as an incident response tool, it enables analysts to investigate the scope, impact, and root cause of an incident efficiently by analyzing patterns of activity indicative of Detecting FIN7 attacks. . Date and time functions. Technology. Threat intelligence, also known as cyber threat intelligence (CTI), is information gathered from a range of sources about current or potential attacks against your organization. For our data, we’ll be using the Boss of the SOC Version 3 (BOTSv3) dataset, which you can use to Splunk State of Security Report. I focus on the application of natural language processing and deep learning to build security analytics. Then, once your investigation is complete, formulate a new query focusing exclusively on results from “Legit Monitoring Agent”. M-ATH is a SURGe -developed method from the PEAK framework, which uses models or algorithms to help find threat-hunting leads, or If you do not have Splunk Enterprise Security, these detections will still give you an idea of what you can accomplish with SPL in the Splunk platform or with the free app, Splunk Security Essentials. This repository serves as the working data for the Corelight Threat Hunting Guide. Threat Hunting with Splunk Presenter: Ken Westin M. doc or . You can no longer rely solely on alerts from point solutions to secure your network. When I look at my Splunk console, I may have hundreds of data sources (“sourcetypes”) stretching over days, weeks, months or years. The search finishes within a few seconds, and Splunk State of Security Report. May 24, 2017 · Threat Hunting with Splunk. The malware that is loaded is a web shell. Detect new open S3 buckets over AWS CLI. Splunk helps by providing centralized log ingestion and analytics against Zscaler logs that are readily ingested and normalized into Splunk’s schema. Splunk can provide the data platform and security analytics capabilities needed to allow organizations to monitor, alert, analyze, investigate, respond, share, and detect Finding Obfuscated Evil. Hypothesis-based methods. As AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting to find sneaky and elusive threats. ThreatHunting | A Splunk app mapped to MITRE ATT&CK to guide your threat hunts. Learn more about the Splunk Threat Research Team . This book arms you with 50 of the top cybersecurity threats. Mar 26, 2024 · Description. FIN7 is a threat actor group which has primarily targeted the U. Before you get started, you should review the types of threat intelligence that Splunk Enterprise Security supports. It discusses threat hunting basics, data sources for threat hunting, knowing your endpoint, and using the cyber kill chain framework. The eval command can help with all this and more: Conditional functions, like if, case and match. The course covers Threat hunting with Splunk from beginner to advanced levels, based on the latest Cybersecurity This is a compilation of Splunk queries that I've collected and used over time. You are a security analyst who needs to Jan 19, 2024 · Hypothesis-driven hunting is probably the most well-known type of threat hunting, and it’s one of the three types defined in the PEAK threat hunting framework. Splunk User Behavior Analytics helps to solve this issue Sep 11, 2023 · This book will guide you through the process of setting up a threat hunting environment using Splunk and provide practical examples of how to detect and investigate threats. Jul 13, 2023 · From the Playbook screen, search for the “Hunting” prebuilt playbook and open it. docx, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using winword. These can be used for threat hunting (e. In this post, we’ll proactively hunt for Cyber Attack Kill Chain from BOTsv1 dataset using Splunk. File integrity monitoring (FIM) can also assist in identifying masquerading. index="botsv1". Let’s look briefly at each use case, and I’ll point you to more resources as we go. This method serves as a starting point for many hunters, as it encourages critical thinking and proactive investigation. Building a SOC starts with threat modeling (see Figure 1). Threat Hunting with Splunk. Hypothesis-based threat hunting uses insights from attackers’ latest tactics, techniques, and procedures (TTP) sourced from crowdsourced threat data. AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Process. If there is no stream:http item in the list, just type it into the query. Zerologon or lateral movement) or detecting suspicious behavior (e. •24x7x365 threat monitoring •Threat identification and alert triage •Threat notification and escalation •Containment, eradication and recovery recommendations •Attack disruption of pre-approved activities •Automated attack containment •Threat 3. Sc, OSCP, ITPM Splunk, Security Market Specialist. Mathematical functions, like round and square root. This tech talk shares how the Splunk Threat Hunting team seamlessly integrated the PEAK Threat Hunting Framework into their workflow while leveraging Splunk. By using Splunk to hunt for threats, organizations can identify In addition, these Splunk resources might help you understand and implement this use case: Blog: Threat Hunting with Splunk: Hands-on Tutorials for the Active Hunter ; If you are a Splunk Enterprise Security customer, you can also get help from the Security Research team's support options on GitHub. It also incorporates the Hunting Maturity Model, which leaders can use to assess the current state of their hunting program and figure out how to get where they would Jun 7, 2019 · I hope this brief introduction gives you an understanding of the threat hunting companion app and how you can use it to raise your game when it comes to using Splunk to threat hunt. We wrote this book to provide an introduction to Splunk and all it can do. 1. You are a security analyst looking to improve threat detection on your endpoints. On the left side, under the Search box, click " No Event Sampling " and click " 1: 100 ". This search looks for spikes in the number of Server Message Block (SMB) traffic connections, which Mar 4, 2024 · In this post, we'll experiment with a method to find masquerading, or suspicious clusters of Chrome extensions using Model-Assisted Threat Hunting (M-ATH) with Splunk and the Data Science & Deep Learning (DSDL) App. Replacing our previous SIEM with Splunk Enterprise Security has dramatically improved our Jul 7, 2023 · Real-world tutorial: Threat hunting in Sysmon Now let’s go hunting! We’ll walk through an actual tutorial for threat hunting in Sysmon. The intelligence pipeline in Splunk Threat Intelligence Management extracts, normalizes, and enriches observables with the intelligence sources that you have access to, which transforms the Checking for files created on a system. You can use the MITRE ATT&CK Navigator to see the TTPs covered by correlation rules in Splunk Enterprise Security. The SOC Cybersecurity Threat Hunting with Splunk training course has been developed and edited by Mohammad Mirasadollahi in an online format, consisting of 68 instructional videos on Splunk, along with practical course files. You can leverage Amazon Web Services (AWS) CloudTrail to give you increased visibility into your user and resource activity by recording AWS Management Console actions and API calls. This is a process where IT security and business people gather to determine key cyberthreats, prioritize them, model out what they would look like in machine data, and then determine how to detect and remediate them. Threat intelligence is everywhere around us. Talk to Splunk security experts! Aug 25, 2023 · The PEAK Threat Hunting Framework incorporates three distinct hunt types: hypothesis-driven, baseline and model-assisted threat hunts. (“Corelight”). It comes in various forms such as IP addresses, URLs, file hashes, vulnerability reports, threat actor reports, etc. The presentation then discusses key building blocks for driving threat hunting maturity, including search and visualization, data enrichment, ingesting data sources, and applying machine learning. Next steps. eval allows you to take search results and perform all sorts of, well, evaluations of the data. exe. Today there are several threat-hunting approaches: hypothesis-based, machine learning, baseline, AI-based and IoC and IoA-based approaches. If you want to follow along at home and are in need of some sample data, then consider looking at the “BOTS V3 dataset on GitHub”. The document is a presentation on threat hunting with Splunk. Threat Detection & Response Threat Intelligence Threat Hunting Incident Response. “Splunk, with its high-speed processing capabilities, is exactly what we are looking for. Select the “Hunt File” action block and adjust The hash* field under “Inputs” to “fileHash”. Analysts can manage security events and leverage threat intelligence feeds directly within Part 1 – Setting up your threat hunting program Hunt Evil: Your Practical Guide to Threat Hunting 6 Tools, techniques, and technology Experience, efficiency, and expertise Planning, preparation, and process A complete project (successful threat hunting) It is also important to keep in mind that successful hunting is tied to capabilities May 8, 2023 · The PEAK threat hunting framework identifies three primary types of hunts: Hypothesis-Driven Hunts. Using the keyword by within the stats command can group the statistical Feb 3, 2016 · The spotlight playbook for today is on Operationalizing Threat Intelligence. Building on rapid response guides, the Splunk Threat Research Team creates detection searches and Splunk SOAR playbooks (where applicable). So, let's make it clear, this entire series is about using Splunk for your threat hunting activities. It begins with an introduction to threat hunting and why it is important. Threat hunting. Created Date Splunk State of Security Report. The source prose which is maintained here is periodically put through editing, layout, and graphic design, and then published as a PDF file and distributed by Corelight, Inc. Deploy PowerShell v5. In line with this mission, we crafted 30+ analytics for M365 initial access techniques, leveraging both the M365 UAL as well as the Azure AD logs. Compliance. You know you need to patch your SolarWinds software, but you also need to look for signs that your systems have been compromised. Learn how Splunk UBA can help you root out insider threats. Checking for files created on a system. For example, if users see that a file ends in . Chronicles of a Threat Hunter: Hunting for In-Memory Mimikatz with Sysmon and ELK Part I (Event ID 7) Part II (Event ID 10) Advanced Incident Detection and Threat Hunting using Sysmon (and Splunk) (botconf 2016 Slides, FIRST 2017 Slides) The Sysmon and Threat Hunting Mimikatz wiki for the blue team; Splunkmon — Taking Sysmon to the Next Level Sampling the Data. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Security analysts are constantly overwhelmed by alerts and repetitive, manual tasks — negatively impacting their ability to triage and investigate critical security events. Product: Splunk SOAR. See how they also joined forces with As threats continue to grow and evolve, you need to understand what your organization is up against to defend against cybersecurity threats from criminals who exploit vulnerabilities to gain access to networks, data and confidential information. Your adversaries continue to attack and get into companies. ta ve uk gg du ie yc zl os rj