misp-warninglists/lists/microsoft/list.json

{
  "description": "Event contains one or more entries of known microsoft domains",
  "list": [
    ".aadrm.com",
    ".afx.ms",
    ".akadns.net",
    ".aspnetcdn.com",
    ".azure-int.net",
    ".azure-mobile.net",
    ".azure.com",
    ".azure.net",
    ".azureedge.net",
    ".azurewebsites.net",
    ".bing-exp.com",
    ".bing-int.com",
    ".bing.com",
    ".bing.net",
    ".ceipmsn.com",
    ".cloudapp.azure.com",
    ".cloudapp.azure.net",
    ".cloudapp.net",
    ".codeplex.com",
    ".discoverbing.com",
    ".files-df.1drv.com",
    ".files.1drv.com",
    ".firstpartyapps.oaspapps.com",
    ".getmicrosoftkey.com",
    ".gfx-int.ms",
    ".gfx.ms",
    ".healthvault-ppe.co.uk",
    ".healthvault-ppe.com",
    ".healthvault.co.uk",
    ".healthvault.com",
    ".hotmail-int.com",
    ".hotmail.com",
    ".live-int.com",
    ".live-int.net",
    ".live-partner.com",
    ".live-ppe.net",
    ".live.com",
    ".live.fi",
    ".live.net",
    ".livefilestore-int.com",
    ".livefilestore.com",
    ".livemeeting.com",
    ".lync.com",
    ".mesh.com",
    ".mgmt.live",
    ".microsoft-int.com",
    ".microsoft.com",
    ".microsoft.com.au",
    ".microsoft.com.tr",
    ".microsoft.fr",
    ".microsoftonline-int.com",
    ".microsoftonline-p-int.com",
    ".microsoftonline-p.com",
    ".microsoftonline-p.net",
    ".microsoftonline.com",
    ".microsoftonline.net",
    ".microsoftprime.com",
    ".microsoftstore.com",
    ".microsoftstore.com.br",
    ".microsoftstore.com.cn",
    ".microsoftstore.com.hk",
    ".microsofttranslator.com",
    ".microsoftvirtualacademy.com",
    ".modern.ie",
    ".msads.net",
    ".msgamestudios.com",
    ".msn-int.com",
    ".msn.cn",
    ".msn.co.jp",
    ".msn.com",
    ".msn.com.cn",
    ".msocdn.com",
    ".office-int.com",
    ".office-int.net",
    ".office.com",
    ".office.net",
    ".office365.com",
    ".officeppe.com",
    ".officeppe.net",
    ".onedrive.com",
    ".onenote.com",
    ".onenote.net",
    ".outlook.com",
    ".pfx.ms",
    ".redmond.corp.microsoft.com",
    ".s-microsoft.com",
    ".s-msft.com",
    ".s-msn.com",
    ".sfx-df.ms",
    ".sfx-int.ms",
    ".sfx.ms",
    ".sharepoint.com",
    ".sharepointonline.com",
    ".skype.com",
    ".skype.net",
    ".skypeassets.com",
    ".sqlazurelabs.com",
    ".surface.com",
    ".syncxp.net",
    ".trouter.io",
    ".virtualearth.net",
    ".visualstudio.com",
    ".vo.msecnd.net",
    ".windows-int.net",
    ".windows.com",
    ".windows.net",
    ".windowsazure.com",
    ".windowsmedia.com",
    ".windowsphone-int.com",
    ".windowsphone-int.net",
    ".windowsphone.com",
    ".windowsphone.net",
    ".windowssearch.com",
    ".windowsstore.com",
    ".windowsupdate.com",
    ".wlxrs.com",
    ".xbox.com",
    ".xboxlive.com",
    ".zune.net",
    "003-1-d.outlook.com",
    "003-1-d.prod.outlook.com",
    "azdns-migration-ns-validation.cn",
    "azure-api.net",
    "azure-apim.net",
    "azure-devices.net",
    "azure-mobile.net",
    "azure.com",
    "azurebiganalytics.net",
    "azuredatacatalog.com",
    "azuredatalake.net",
    "azuredatalakeanalytics.net",
    "azuredatalakestore.net",
    "azureedge.net",
    "azurehdinsight-stage.net",
    "azurehdinsight.net",
    "azurewebsites.net",
    "bing.com",
    "cloudapp-int.net",
    "cloudapp-preview.com",
    "cloudapp-preview.net",
    "cloudapp.net",
    "clouddatahub.net",
    "cloudwebappproxy.net",
    "community-stage.skype.com",
    "download.cortana.cn.bing.com",
    "download.microsoft.com",
    "gfx-int.ms",
    "hdinsightservices.net",
    "healthvault-ppe.com",
    "homeserver.com",
    "hotmail.co.uk",
    "hotmail.com",
    "iespdytst",
    "iespdytst.redmond.corp.microsoft.com",
    "ieta-wa-24",
    "insidersurveys.windows.com",
    "live.fi",
    "management-azure-devices.net",
    "mgmt-azure-api.net",
    "microsoft.com",
    "microsoftcrmportals.com",
    "microsoftcrmportalstest.com",
    "microsoftkonacompute.net",
    "microsoftprojecttokyo.com",
    "microsoftstream.com",
    "modern.ie",
    "msappproxy.net",
    "o365apps.net",
    "office-int.com",
    "office.com",
    "onedrive.com",
    "onenote.com",
    "outlook-int.com",
    "outlook.com",
    "pbiwebcontent.com",
    "pod71084-pri.outlook.com",
    "pod71084.outlook.com",
    "powerbi.com",
    "powerusers-staging.microsoft.com",
    "powerusers.microsoft.com",
    "remotewebaccess.com",
    "stage-azurewebsites.net",
    "stage-o365apps.net",
    "telecommand.telemetry.microsoft.com",
    "visualstudio.com",
    "vortex-sandbox.data.microsoft.com",
    "vsallin.net",
    "vsassets.io",
    "watson.telemetry.microsoft.com",
    "www.insidersurveys.windows.com",
    "za.microsoftstore.com"
  ],
  "matching_attributes": [
    "domain",
    "hostname",
    "domain|ip"
  ],
  "name": "List of known microsoft domains",
  "type": "string",
  "version": 4
}