{
  "name": "List of known microsoft domains",
  "version": 1,
  "description": "Event contains one or more entries of known microsoft domains",
  "matching_attributes": [ "domain", "hostname", "domain|ip" ],
  "list": [
        ".files-df.1drv.com",
        ".files.1drv.com",
        ".aadrm.com",
        ".afx.ms",
        ".akadns.net",
        ".aspnetcdn.com",
        ".azure-int.net",
        ".azure-mobile.net",
        ".azure.com",
        ".cloudapp.azure.com",
        "azure.com",
        ".azure.net",
        ".cloudapp.azure.net",
        ".azureedge.net",
        ".azurewebsites.net",
        ".bing-exp.com",
        ".bing-int.com",
        ".bing.com",
        "bing.com",
        "download.cortana.cn.bing.com",
        ".bing.net",
        ".ceipmsn.com",
        ".cloudapp.net",
        ".codeplex.com",
        ".discoverbing.com",
        ".getmicrosoftkey.com",
        ".gfx-int.ms",
        "gfx-int.ms",
        ".gfx.ms",
        ".healthvault-ppe.co.uk",
        ".healthvault-ppe.com",
        "healthvault-ppe.com",
        ".healthvault.co.uk",
        ".healthvault.com",
        ".hotmail-int.com",
        "hotmail.co.uk",
        ".hotmail.com",
        "hotmail.com",
        "iespdytst",
        "ieta-wa-24",
        ".live-int.com",
        ".live-int.net",
        ".live-partner.com",
        ".live-ppe.net",
        ".live.com",
        ".live.fi",
        "live.fi",
        ".live.net",
        ".livefilestore-int.com",
        ".livefilestore.com",
        ".livemeeting.com",
        ".lync.com",
        ".mesh.com",
        ".mgmt.live",
        ".microsoft-int.com",
        ".microsoft.com",
        ".redmond.corp.microsoft.com",
        "download.microsoft.com",
        "iespdytst.redmond.corp.microsoft.com",
        "microsoft.com",
        "powerusers-staging.microsoft.com",
        "powerusers.microsoft.com",
        "telecommand.telemetry.microsoft.com",
        "vortex-sandbox.data.microsoft.com",
        "watson.telemetry.microsoft.com",
        ".microsoft.com.au",
        ".microsoft.com.tr",
        ".microsoft.fr",
        ".microsoftonline-int.com",
        ".microsoftonline-p-int.com",
        ".microsoftonline-p.com",
        ".microsoftonline-p.net",
        ".microsoftonline.com",
        ".microsoftonline.net",
        ".microsoftprime.com",
        ".microsoftstore.com",
        "za.microsoftstore.com",
        ".microsoftstore.com.br",
        ".microsoftstore.com.cn",
        ".microsoftstore.com.hk",
        ".microsofttranslator.com",
        ".microsoftvirtualacademy.com",
        ".modern.ie",
        "modern.ie",
        ".msads.net",
        ".vo.msecnd.net",
        ".msgamestudios.com",
        ".msn-int.com",
        ".msn.cn",
        ".msn.co.jp",
        ".msn.com",
        ".msn.com.cn",
        ".msocdn.com",
        ".firstpartyapps.oaspapps.com",
        ".office-int.com",
        "office-int.com",
        ".office-int.net",
        ".office.com",
        "office.com",
        ".office.net",
        ".office365.com",
        ".officeppe.com",
        ".officeppe.net",
        ".onedrive.com",
        "onedrive.com",
        ".onenote.com",
        "onenote.com",
        ".onenote.net",
        "outlook-int.com",
        ".outlook.com",
        "003-1-d.outlook.com",
        "003-1-d.prod.outlook.com",
        "outlook.com",
        "pod71084-pri.outlook.com",
        "pod71084.outlook.com",
        ".pfx.ms",
        ".s-microsoft.com",
        ".s-msft.com",
        ".s-msn.com",
        ".sfx-df.ms",
        ".sfx-int.ms",
        ".sfx.ms",
        ".sharepoint.com",
        ".sharepointonline.com",
        ".skype.com",
        "community-stage.skype.com",
        ".skype.net",
        ".skypeassets.com",
        ".sqlazurelabs.com",
        ".surface.com",
        ".syncxp.net",
        ".trouter.io",
        ".virtualearth.net",
        ".visualstudio.com",
        "visualstudio.com",
        ".windows-int.net",
        ".windows.com",
        "insidersurveys.windows.com",
        "www.insidersurveys.windows.com",
        ".windows.net",
        ".windowsazure.com",
        ".windowsmedia.com",
        ".windowsphone-int.com",
        ".windowsphone-int.net",
        ".windowsphone.com",
        ".windowsphone.net",
        ".windowssearch.com",
        ".windowsstore.com",
        ".wlxrs.com",
        ".xbox.com",
        ".xboxlive.com",
        ".zune.net"
   ]
}