add: [microsoft-attack-simulator] warning list about phishing campaign for "security awareness"

2018-07-11 08:33:28 +02:00 · 2018-07-11 08:33:28 +02:00 · d378c4e9ef
parent 1dde5442d9
commit d378c4e9ef
1 changed files with 25 additions and 0 deletions
--- a/lists/microsoft-attack-simulator/list.json
+++ b/lists/microsoft-attack-simulator/list.json
@ -0,0 +1,25 @@
+{
+  "matching_attributes": [
+    "ip-src",
+    "ip-dst",
+    "domain|ip",
+    "hostname"
+  ],
+  "version": 20180711,
+  "list": [
+    "52.168.52.134",
+    "securescore-user-prod.cloudapp.net",
+    "portal.docdeliveryapp.com",
+    "portal.hardwarecheck.net",
+    "portal.payrolltooling.com",
+    "portal.docdeliveryapp.net",
+    "portal.docstoreinternal.com",
+    "portal.prizesforall.com",
+    "portal.payrolltooling.net",
+    "portal.prizegiveaway.net",
+    "portal.hrsupportint.com"
+  ],
+  "name": "List of known Office 365 Attack Simulator used for phishing awareness campaigns",
+  "description": "Office 365 URLs and IP address ranges used for their attack simulator in Office 365 Threat Intelligence",
+  "type": "substring"
+}