misp-warninglists/lists/microsoft/list.json

206 lines
4.8 KiB
JSON

{
"description": "Event contains one or more entries of known microsoft domains",
"list": [
".aadrm.com",
".afx.ms",
".akadns.net",
".aspnetcdn.com",
".azure-int.net",
".azure-mobile.net",
".azure.com",
".azure.net",
".azureedge.net",
".azurewebsites.net",
".bing-exp.com",
".bing-int.com",
".bing.com",
".bing.net",
".ceipmsn.com",
".cloudapp.azure.com",
".cloudapp.azure.net",
".cloudapp.net",
".codeplex.com",
".discoverbing.com",
".files-df.1drv.com",
".files.1drv.com",
".firstpartyapps.oaspapps.com",
".getmicrosoftkey.com",
".gfx-int.ms",
".gfx.ms",
".healthvault-ppe.co.uk",
".healthvault-ppe.com",
".healthvault.co.uk",
".healthvault.com",
".hotmail-int.com",
".hotmail.com",
".live-int.com",
".live-int.net",
".live-partner.com",
".live-ppe.net",
".live.com",
".live.fi",
".live.net",
".livefilestore-int.com",
".livefilestore.com",
".livemeeting.com",
".lync.com",
".mesh.com",
".mgmt.live",
".microsoft-int.com",
".microsoft.com",
".microsoft.com.au",
".microsoft.com.tr",
".microsoft.fr",
".microsoftonline-int.com",
".microsoftonline-p-int.com",
".microsoftonline-p.com",
".microsoftonline-p.net",
".microsoftonline.com",
".microsoftonline.net",
".microsoftprime.com",
".microsoftstore.com",
".microsoftstore.com.br",
".microsoftstore.com.cn",
".microsoftstore.com.hk",
".microsofttranslator.com",
".microsoftvirtualacademy.com",
".modern.ie",
".msads.net",
".msgamestudios.com",
".msn-int.com",
".msn.cn",
".msn.co.jp",
".msn.com",
".msn.com.cn",
".msocdn.com",
".office-int.com",
".office-int.net",
".office.com",
".office.net",
".office365.com",
".officeppe.com",
".officeppe.net",
".onedrive.com",
".onenote.com",
".onenote.net",
".outlook.com",
".pfx.ms",
".redmond.corp.microsoft.com",
".s-microsoft.com",
".s-msft.com",
".s-msn.com",
".sfx-df.ms",
".sfx-int.ms",
".sfx.ms",
".sharepoint.com",
".sharepointonline.com",
".skype.com",
".skype.net",
".skypeassets.com",
".sqlazurelabs.com",
".surface.com",
".syncxp.net",
".trouter.io",
".virtualearth.net",
".visualstudio.com",
".vo.msecnd.net",
".windows-int.net",
".windows.com",
".windows.net",
".windowsazure.com",
".windowsmedia.com",
".windowsphone-int.com",
".windowsphone-int.net",
".windowsphone.com",
".windowsphone.net",
".windowssearch.com",
".windowsstore.com",
".windowsupdate.com",
".wlxrs.com",
".xbox.com",
".xboxlive.com",
".zune.net",
"003-1-d.outlook.com",
"003-1-d.prod.outlook.com",
"azdns-migration-ns-validation.cn",
"azure-api.net",
"azure-apim.net",
"azure-devices.net",
"azure-mobile.net",
"azure.com",
"azurebiganalytics.net",
"azuredatacatalog.com",
"azuredatalake.net",
"azuredatalakeanalytics.net",
"azuredatalakestore.net",
"azureedge.net",
"azurehdinsight-stage.net",
"azurehdinsight.net",
"azurewebsites.net",
"bing.com",
"cloudapp-int.net",
"cloudapp-preview.com",
"cloudapp-preview.net",
"cloudapp.net",
"clouddatahub.net",
"cloudwebappproxy.net",
"community-stage.skype.com",
"download.cortana.cn.bing.com",
"download.microsoft.com",
"gfx-int.ms",
"hdinsightservices.net",
"healthvault-ppe.com",
"homeserver.com",
"hotmail.co.uk",
"hotmail.com",
"iespdytst",
"iespdytst.redmond.corp.microsoft.com",
"ieta-wa-24",
"insidersurveys.windows.com",
"live.fi",
"management-azure-devices.net",
"mgmt-azure-api.net",
"microsoft.com",
"microsoftcrmportals.com",
"microsoftcrmportalstest.com",
"microsoftkonacompute.net",
"microsoftprojecttokyo.com",
"microsoftstream.com",
"modern.ie",
"msappproxy.net",
"o365apps.net",
"office-int.com",
"office.com",
"onedrive.com",
"onenote.com",
"outlook-int.com",
"outlook.com",
"pbiwebcontent.com",
"pod71084-pri.outlook.com",
"pod71084.outlook.com",
"powerbi.com",
"powerusers-staging.microsoft.com",
"powerusers.microsoft.com",
"remotewebaccess.com",
"stage-azurewebsites.net",
"stage-o365apps.net",
"telecommand.telemetry.microsoft.com",
"visualstudio.com",
"vortex-sandbox.data.microsoft.com",
"vsallin.net",
"vsassets.io",
"watson.telemetry.microsoft.com",
"www.insidersurveys.windows.com",
"za.microsoftstore.com"
],
"matching_attributes": [
"domain",
"hostname",
"domain|ip",
"url"
],
"name": "List of known microsoft domains",
"type": "string",
"version": 5
}