MISP
/
misp-warninglists
mirror of https://github.com/MISP/misp-warninglists
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #188 from JakubOnderka/office365-cn 

chg: [microsoft-office365-cn] Update to latest version
pull/189/head
Alexandre Dulaunoy 2021-06-13 07:36:08 +02:00 committed by GitHub
parent d9f61e32bf 7dfdb1dbaf
commit 0c8d517366
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 112 additions and 102 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
generate_all.sh
View File

@ -18,8 +18,6 @@ python3 generate_majestic-million.py
python3 generate-microsoft-azure.py
python3 generate_mozilla_certificates.py
python3 generate_moz-top500.py
# Deprecate?
#python3 generate-office365-cn.py > lists/microsoft-office365-cn/list.json
python3 generate-office365.py
python3 generate_phone_numbers.py
python3 generate-publicdns.py

175
lists/microsoft-office365-cn/list.json
View File

@ -1,79 +1,106 @@
{
"description": "Office 365 IP address ranges in China",
"list": [
"139.217.0.0/19",
"139.217.128.0/19",
"139.217.160.0/26",
"139.217.160.128/28",
"139.217.160.64/27",
"139.217.161.0/24",
"139.217.162.0/24",
"139.217.192.0/20",
"139.217.32.0/24",
"139.217.40.0/27",
"139.217.40.32/28",
"139.219.0.0/20",
"139.219.128.0/20",
"139.219.160.0/19",
"139.219.192.0/19",
"139.219.224.0/20",
"139.219.240.0/24",
"139.219.241.0/24",
"139.219.242.0/23",
"139.219.244.0/22",
"139.219.32.0/19",
"139.219.64.0/18",
"40.125.128.0/17",
"40.126.88.0/28",
"40.126.88.128/25",
"40.126.88.16/28",
"40.126.88.32/27",
"40.126.88.64/28",
"40.126.88.80/28",
"40.126.88.96/27",
"40.126.89.0/24",
"40.126.90.0/23",
"40.126.92.0/22",
"40.126.96.0/19",
"40.72.127.0/27",
"40.72.128.0/24",
"40.72.136.0/21",
"40.72.144.0/20",
"40.72.160.0/21",
"40.72.192.0/28",
"40.72.192.16/28",
"40.72.192.48/28",
"40.72.193.0/27",
"40.72.224.0/20",
"40.72.64.0/27",
"42.159.0.0/26",
"42.159.0.144/28",
"42.159.129.0/24",
"42.159.130.0/26",
"42.159.130.144/28",
"42.159.132.0/22",
"42.159.136.0/22",
"42.159.140.0/26",
"42.159.140.96/27",
"42.159.141.0/24",
"42.159.142.0/23",
"42.159.144.0/20",
"42.159.16.0/26",
"42.159.16.96/27",
"42.159.17.0/24",
"42.159.18.0/23",
"42.159.192.0/20",
"42.159.20.0/22",
"42.159.208.0/27",
"42.159.208.32/28",
"42.159.208.64/26",
"42.159.224.0/19",
"42.159.24.0/21",
"42.159.4.0/22",
"42.159.65.0/25",
"42.159.8.0/21",
"42.159.80.0/20",
"42.159.96.0/19"
"101.28.252.0/24",
"103.9.8.0/22",
"112.25.33.0/24",
"115.231.150.0/24",
"123.150.49.0/24",
"123.235.32.0/24",
"125.65.247.0/24",
"139.217.115.121/32",
"139.217.118.25/32",
"139.217.118.46/32",
"139.217.118.54/32",
"139.217.17.219/32",
"139.217.19.156/32",
"139.217.21.3/32",
"139.217.228.95/32",
"139.217.231.198/32",
"139.217.231.208/32",
"139.217.231.219/32",
"139.217.25.244/32",
"139.219.132.56/32",
"139.219.133.182/32",
"139.219.145.0/27",
"139.219.146.0/24",
"139.219.156.0/22",
"139.219.16.0/27",
"139.219.17.0/24",
"139.219.24.0/22",
"168.63.252.62/32",
"171.107.84.0/24",
"171.111.154.0/24",
"175.6.10.0/24",
"180.210.229.0/24",
"180.210.232.0/24",
"180.210.234.0/24",
"182.50.87.0/24",
"209.177.86.0/24",
"209.177.90.0/24",
"209.177.94.0/24",
"211.90.28.0/24",
"222.161.226.0/24",
"23.236.126.0/24",
"2406:e500:4000:2::/63",
"2406:e500:4101:2::/64",
"2406:e500:4440::/43",
"2406:e500:5500::/48",
"2406:e500:c020::/44",
"2406:e500:c120::/44",
"40.73.129.0/24",
"40.73.132.0/24",
"40.73.161.0/24",
"40.73.164.128/25",
"40.73.165.0/26",
"40.73.248.0/21",
"40.73.248.8/32",
"40.73.252.10/32",
"42.159.132.138/32",
"42.159.132.73/32",
"42.159.132.74/32",
"42.159.132.75/32",
"42.159.133.17/32",
"42.159.135.78/32",
"42.159.161.192/27",
"42.159.162.0/27",
"42.159.162.32/27",
"42.159.162.64/27",
"42.159.162.96/28",
"42.159.163.128/25",
"42.159.164.0/24",
"42.159.165.0/24",
"42.159.166.0/23",
"42.159.224.122/32",
"42.159.233.91/32",
"42.159.237.146/32",
"42.159.238.120/32",
"42.159.33.192/27",
"42.159.34.0/27",
"42.159.34.32/27",
"42.159.34.64/27",
"42.159.34.96/28",
"42.159.36.0/24",
"42.159.38.0/23",
"42.159.4.200/32",
"42.159.4.225/32",
"42.159.4.45/32",
"42.159.4.50/32",
"42.159.4.68/32",
"42.159.40.0/24",
"42.159.7.13/32",
"42.159.7.156/32",
"42.159.87.106/32",
"42.159.92.96/32",
"52.130.17.192/27",
"52.130.18.32/27",
"52.130.2.32/27",
"52.130.3.64/27",
"58.68.168.0/24",
"65.52.98.231/32",
"65.55.227.140/32",
"65.55.69.140/32",
"70.37.81.47/32"
],
"matching_attributes": [
"ip-src",
@ -82,5 +109,5 @@
],
"name": "List of known Office 365 IP address ranges in China",
"type": "cidr",
"version": 20171229
"version": 20210612
}

25
tools/generate-office365-cn.py
View File

@ -1,25 +0,0 @@
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import requests
import xml.etree.ElementTree as ET
import json
import datetime
url = 'https://download.microsoft.com/download/3/5/3/353F871C-5CF8-4CF8-8A76-6A88D9CA1ABE/PublicIPs_MC_20171211.xml'
r = requests.get(url)
office365 = ET.fromstring(r.text)
l = []
for region in office365.iter('Region'):
for subnet in region.iter('IpRange'):
l.append(subnet.get('Subnet'))
warninglist = {}
warninglist['name'] = 'List of known Office 365 IP address ranges in China'
warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d'))
warninglist['description'] = 'Office 365 IP address ranges in China'
warninglist['list'] = sorted(set(l))
warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"]
warninglist['type'] = 'cidr'
print(json.dumps(warninglist))

12
tools/generate-office365.py
View File

@ -55,6 +55,16 @@ def get_lists(url):
if __name__ == '__main__':
# For more info see https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service?view=o365-worldwide
office365_url = 'https://endpoints.office.com/endpoints/worldwide?clientrequestid=b10c5ed1-bad1-445f-b386-b919946339a7'
process(office365_url)
office365_url_china = 'https://endpoints.office.com/endpoints/China?ClientRequestId=b10c5ed1-bad1-445f-b386-b919946339a7'
_, lips = get_lists(office365_url_china)
warninglist = {
'name': 'List of known Office 365 IP address ranges in China',
'description': 'Office 365 IP address ranges in China',
'type': 'cidr',
'matching_attributes': ["ip-src", "ip-dst", "domain|ip"]
}
generate(lips, "microsoft-office365-cn", warninglist)