I generally agree w/ this take on Grizzly Steppe, given info available: http://blog.erratasec.com/2016/12/some-notes-on-iocs.html