From 3551d2aba9153d44de23c443ab0eeacf531b31fc Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Sat, 1 Oct 2016 20:07:25 +0200
Subject: [PATCH] warning list of known microsoft domains added

---
 lists/microsoft/list.json | 161 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 161 insertions(+)
 create mode 100644 lists/microsoft/list.json

diff --git a/lists/microsoft/list.json b/lists/microsoft/list.json
new file mode 100644
index 0000000..dd4a074
--- /dev/null
+++ b/lists/microsoft/list.json
@@ -0,0 +1,161 @@
+{
+  "name": "List of known microsoft domains",
+  "version": 1,
+  "description": "Event contains one or more entries of known microsoft domains",
+  "matching_attributes": [ "domain", "hostname", "domain|ip" ],
+  "list": [
+        ".files-df.1drv.com",
+        ".files.1drv.com",
+        ".aadrm.com",
+        ".afx.ms",
+        ".akadns.net",
+        ".aspnetcdn.com",
+        ".azure-int.net",
+        ".azure-mobile.net",
+        ".azure.com",
+        ".cloudapp.azure.com",
+        "azure.com",
+        ".azure.net",
+        ".cloudapp.azure.net",
+        ".azureedge.net",
+        ".azurewebsites.net",
+        ".bing-exp.com",
+        ".bing-int.com",
+        ".bing.com",
+        "bing.com",
+        "download.cortana.cn.bing.com",
+        ".bing.net",
+        ".ceipmsn.com",
+        ".cloudapp.net",
+        ".codeplex.com",
+        ".discoverbing.com",
+        ".getmicrosoftkey.com",
+        ".gfx-int.ms",
+        "gfx-int.ms",
+        ".gfx.ms",
+        ".healthvault-ppe.co.uk",
+        ".healthvault-ppe.com",
+        "healthvault-ppe.com",
+        ".healthvault.co.uk",
+        ".healthvault.com",
+        ".hotmail-int.com",
+        "hotmail.co.uk",
+        ".hotmail.com",
+        "hotmail.com",
+        "iespdytst",
+        "ieta-wa-24",
+        ".live-int.com",
+        ".live-int.net",
+        ".live-partner.com",
+        ".live-ppe.net",
+        ".live.com",
+        ".live.fi",
+        "live.fi",
+        ".live.net",
+        ".livefilestore-int.com",
+        ".livefilestore.com",
+        ".livemeeting.com",
+        ".lync.com",
+        ".mesh.com",
+        ".mgmt.live",
+        ".microsoft-int.com",
+        ".microsoft.com",
+        ".redmond.corp.microsoft.com",
+        "download.microsoft.com",
+        "iespdytst.redmond.corp.microsoft.com",
+        "microsoft.com",
+        "powerusers-staging.microsoft.com",
+        "powerusers.microsoft.com",
+        "telecommand.telemetry.microsoft.com",
+        "vortex-sandbox.data.microsoft.com",
+        "watson.telemetry.microsoft.com",
+        ".microsoft.com.au",
+        ".microsoft.com.tr",
+        ".microsoft.fr",
+        ".microsoftonline-int.com",
+        ".microsoftonline-p-int.com",
+        ".microsoftonline-p.com",
+        ".microsoftonline-p.net",
+        ".microsoftonline.com",
+        ".microsoftonline.net",
+        ".microsoftprime.com",
+        ".microsoftstore.com",
+        "za.microsoftstore.com",
+        ".microsoftstore.com.br",
+        ".microsoftstore.com.cn",
+        ".microsoftstore.com.hk",
+        ".microsofttranslator.com",
+        ".microsoftvirtualacademy.com",
+        ".modern.ie",
+        "modern.ie",
+        ".msads.net",
+        ".vo.msecnd.net",
+        ".msgamestudios.com",
+        ".msn-int.com",
+        ".msn.cn",
+        ".msn.co.jp",
+        ".msn.com",
+        ".msn.com.cn",
+        ".msocdn.com",
+        ".firstpartyapps.oaspapps.com",
+        ".office-int.com",
+        "office-int.com",
+        ".office-int.net",
+        ".office.com",
+        "office.com",
+        ".office.net",
+        ".office365.com",
+        ".officeppe.com",
+        ".officeppe.net",
+        ".onedrive.com",
+        "onedrive.com",
+        ".onenote.com",
+        "onenote.com",
+        ".onenote.net",
+        "outlook-int.com",
+        ".outlook.com",
+        "003-1-d.outlook.com",
+        "003-1-d.prod.outlook.com",
+        "outlook.com",
+        "pod71084-pri.outlook.com",
+        "pod71084.outlook.com",
+        ".pfx.ms",
+        ".s-microsoft.com",
+        ".s-msft.com",
+        ".s-msn.com",
+        ".sfx-df.ms",
+        ".sfx-int.ms",
+        ".sfx.ms",
+        ".sharepoint.com",
+        ".sharepointonline.com",
+        ".skype.com",
+        "community-stage.skype.com",
+        ".skype.net",
+        ".skypeassets.com",
+        ".sqlazurelabs.com",
+        ".surface.com",
+        ".syncxp.net",
+        ".trouter.io",
+        ".virtualearth.net",
+        ".visualstudio.com",
+        "visualstudio.com",
+        ".windows-int.net",
+        ".windows.com",
+        "insidersurveys.windows.com",
+        "www.insidersurveys.windows.com",
+        ".windows.net",
+        ".windowsazure.com",
+        ".windowsmedia.com",
+        ".windowsphone-int.com",
+        ".windowsphone-int.net",
+        ".windowsphone.com",
+        ".windowsphone.net",
+        ".windowssearch.com",
+        ".windowsstore.com",
+        ".wlxrs.com",
+        ".xbox.com",
+        ".xboxlive.com",
+        ".zune.net"
+   ]
+}
+