misp-warninglists/lists/microsoft-office365/list.json

227 lines
6.2 KiB
JSON

{
"description": "Office 365 URLs and IP address ranges",
"list": [
"aadrm.com",
"account.activedirectory.windowsazure.com",
"account.live.com",
"account.office.net",
"accounts.accesscontrol.windows.net",
"acompli.net",
"activation.sls.microsoft.com",
"activity.windows.com",
"adl.windows.com",
"admin.microsoft.com",
"admin.onedrive.com",
"adminwebservice.microsoftonline.com",
"ajax.aspnetcdn.com",
"aka.ms",
"amp.azure.net",
"api.passwordreset.microsoftonline.com",
"apis.live.net",
"appex-rf.msn.com",
"appex.bing.com",
"apps.identrust.com",
"appsforoffice.microsoft.com",
"aria.microsoft.com",
"assets-yammer.com",
"assets.onestore.ms",
"auth.gfx.ms",
"auth.microsoft.com",
"autologon.microsoftazuread-sso.com",
"azure-apim.net",
"azureedge.net",
"azurerms.com",
"becws.microsoftonline.com",
"blob.core.windows.net",
"broadcast.skype.com",
"c.bing.com",
"c.bing.net",
"c.live.com",
"c1.microsoft.com",
"cacerts.digicert.com",
"ccs.login.microsoftonline.com",
"cdn.odc.officeapps.live.com",
"cdn.onenote.net",
"cdn.uci.officeapps.live.com",
"cdnprod.myanalytics.microsoft.com",
"cert.int-x3.letsencrypt.org",
"clientconfig.microsoftonline-p.net",
"cloud.microsoft",
"cloudapp.net",
"companymanager.microsoftonline.com",
"compass-ssl.microsoft.com",
"compliance.microsoft.com",
"cortana.ai",
"crl.globalsign.com",
"crl.globalsign.net",
"crl.identrust.com",
"crl.microsoft.com",
"crl3.digicert.com",
"crl4.digicert.com",
"d.docs.live.net",
"dc.services.visualstudio.com",
"defender.microsoft.com",
"device.login.microsoftonline.com",
"dgps.support.microsoft.com",
"directory.services.live.com",
"docs.live.net",
"docs.microsoft.com",
"ecdn.microsoft.com",
"ecn.dev.virtualearth.net",
"enterpriseregistration.windows.net",
"entrust.net",
"eus-www.sway-cdn.com",
"eus-www.sway-extensions.com",
"events.data.microsoft.com",
"excelbingmap.firstpartyapps.oaspapps.com",
"firstpartyapps.oaspapps.com",
"flow.microsoft.com",
"g.live.com",
"geotrust.com",
"go.microsoft.com",
"graph.microsoft.com",
"graph.windows.net",
"hip.live.com",
"informationprotection.azure.com",
"informationprotection.hosting.portal.azure.net",
"isrg.trustid.ocsp.identrust.com",
"keydelivery.mediaservices.windows.net",
"login-us.microsoftonline.com",
"login.live.com",
"login.microsoft.com",
"login.microsoftonline-p.com",
"login.microsoftonline.com",
"login.windows-ppe.net",
"login.windows.net",
"logincert.microsoftonline.com",
"loginex.microsoftonline.com",
"lync.com",
"mail.protection.outlook.com",
"management.azure.com",
"media.azure.net",
"mem.gfx.ms",
"microsoft.com",
"microsoftonline-p.com",
"microsoftonline.com",
"microsoftstream.com",
"microsoftusercontent.com",
"mlccdn.blob.core.windows.net",
"mlccdnprod.azureedge.net",
"msauth.net",
"msauthimages.net",
"mscrl.microsoft.com",
"msdn.microsoft.com",
"msecnd.net",
"msftauth.net",
"msftauthimages.net",
"msftidentity.com",
"msidentity.com",
"msocdn.com",
"mstea.ms",
"myanalytics-gcc.microsoft.com",
"myanalytics.microsoft.com",
"nexus.microsoftonline-p.com",
"nps.onyx.azure.net",
"o15.officeredir.microsoft.com",
"o365weve.com",
"ocos-office365-s2s.msedge.net",
"ocsp.digicert.com",
"ocsp.globalsign.com",
"ocsp.int-x3.letsencrypt.org",
"ocsp.msocsp.com",
"ocsp2.globalsign.com",
"ocspx.digicert.com",
"office.com",
"office.live.com",
"office.net",
"office15client.microsoft.com",
"office365.com",
"officeapps.live.com",
"officecdn.microsoft.com",
"officecdn.microsoft.com.edgesuite.net",
"officeclient.microsoft.com",
"officepreviewredir.microsoft.com",
"officeredir.microsoft.com",
"officespeech.platform.bing.com",
"omniroot.com",
"oneclient.sfx.ms",
"onenote.com",
"online.office.com",
"onmicrosoft.com",
"outlook.com",
"outlook.office.com",
"outlook.office365.com",
"outlookmobile.com",
"partnerservices.getmicrosoftkey.com",
"passwordreset.microsoftonline.com",
"peoplegraph.firstpartyapps.oaspapps.com",
"phonefactor.net",
"platform.linkedin.com",
"policykeyservice.dc.ad.msft.net",
"portal.cloudappsecurity.com",
"powerapps.com",
"prod.firstpartyapps.oaspapps.com.akadns.net",
"prod.msocdn.com",
"protection.office.com",
"protection.outlook.com",
"provisioningapi.microsoftonline.com",
"public-trust.com",
"r.office.microsoft.com",
"search.production.apac.trafficmanager.net",
"search.production.emea.trafficmanager.net",
"search.production.us.trafficmanager.net",
"secure.globalsign.com",
"secure.skypeassets.com",
"security.microsoft.com",
"sfbassets.com",
"sharepoint.com",
"sharepointonline.com",
"shellprod.msocdn.com",
"signup.live.com",
"skype.com",
"skypeforbusiness.com",
"smtp.office365.com",
"spoprod-a.akamaihd.net",
"ssw.live.com",
"staffhub.ms",
"storage.live.com",
"streaming.mediaservices.windows.net",
"support.microsoft.com",
"svc.ms",
"sway.com",
"symcb.com",
"symcd.com",
"teams.microsoft.com",
"technet.microsoft.com",
"telemetryservice.firstpartyapps.oaspapps.com",
"tse1.mm.bing.net",
"users.storage.live.com",
"verisign.com",
"verisign.net",
"virtualearth.net",
"wikipedia.firstpartyapps.oaspapps.com",
"wns.windows.com",
"wus-firstpartyapps.oaspapps.com",
"wus-www.sway-cdn.com",
"wus-www.sway-extensions.com",
"www.acompli.com",
"www.bing.com",
"www.digicert.com",
"www.microsoft.com",
"www.microsoft365.com",
"www.onedrive.com",
"www.outlook.com",
"www.sway.com",
"yammer.com",
"yammerusercontent.com"
],
"matching_attributes": [
"domain",
"domain|ip",
"hostname"
],
"name": "List of known Office 365 URLs",
"type": "string",
"version": 20230205
}