misp-warninglists/lists/microsoft-office365/list.json

420 lines
12 KiB
JSON

{
"description": "Office 365 URLs",
"list": [
"-files.sharepoint.com",
"-myfiles.sharepoint.com",
".aadrm.com",
".acompli.net",
".adhybridhealth.azure.com",
".adl.windows.com",
".api.microsoftstream.com",
".appex-rf.msn.com",
".appex.bing.com",
".aria.microsoft.com",
".assets-yammer.com",
".azureedge.net",
".azurerms.com",
".blob.core.windows.net",
".broadcast.skype.com",
".cdn.office.net",
".cloudapp.net",
".entrust.net",
".events.data.microsoft.com",
".geotrust.com",
".helpshift.com",
".hockeyapp.net",
".informationprotection.azure.com",
".itunes.apple.com",
".keydelivery.mediaservices.windows.net",
".localytics.com",
".log.optimizely.com",
".loki.delve.office.com",
".lync.com",
".mail.protection.outlook.com",
".manage.microsoft.com",
".manage.office.com",
".media.azure.net",
".microsoft.com",
".microsoftonline-p.com",
".microsoftonline-p.net",
".microsoftonline.com",
".msappproxy.net",
".msauth.net",
".msauthimages.net",
".msecnd.net",
".msedge.net",
".msftauth.net",
".msftauthimages.net",
".msocdn.com",
".mstea.ms",
".notification.api.microsoftstream.com",
".o365weve.com",
".office.com",
".office.net",
".office365.com",
".officeconfig.msocdn.com",
".omniroot.com",
".onenote.com",
".onmicrosoft.com",
".outlook.com",
".outlook.office.com",
".outlookmobile.com",
".outlookmobile.us",
".phonefactor.net",
".portal.cloudappsecurity.com",
".protection.office.com",
".protection.outlook.com",
".public-trust.com",
".queue.core.windows.net",
".search.production.apac.trafficmanager.net",
".search.production.emea.trafficmanager.net",
".search.production.us.trafficmanager.net",
".secure.skypeassets.com",
".servicebus.windows.net",
".sfbassets.com",
".sharepoint.com",
".sharepointonline.com",
".skype.com",
".skypeforbusiness.com",
".staffhub.office.com",
".streaming.mediaservices.windows.net",
".svc.ms",
".symcb.com",
".symcd.com",
".table.core.windows.net",
".teams.microsoft.com",
".tenor.com",
".urlp.sfbassets.com",
".users.storage.live.com",
".verisign.com",
".verisign.net",
".windows.net",
".yammer.com",
".yammerusercontent.com",
"a.wunderlist.com",
"account.activedirectory.windowsazure.com",
"account.live.com",
"account.office.net",
"accounts.accesscontrol.windows.net",
"accounts.google.com",
"acompli.helpshift.com",
"activation.sls.microsoft.com",
"ad.atdmt.com",
"admin.microsoft.com",
"admin.onedrive.com",
"adminwebservice.microsoftonline.com",
"aia.entrust.net",
"ajax.aspnetcdn.com",
"ajax.microsoft.com",
"aka.ms",
"amp.azure.net",
"amsglob0cdnstream11.azureedge.net",
"amsglob0cdnstream12.azureedge.net",
"analytics.localytics.com",
"apc.delve.office.com",
"api.diagnostics.office.com",
"api.dropboxapi.com",
"api.localytics.com",
"api.login.microsoftonline.com",
"api.login.yahoo.com",
"api.meetup.com",
"api.microsoftstream.com",
"api.office.com",
"api.passwordreset.microsoftonline.com",
"apis.live.net",
"app.adjust.com",
"app.box.com",
"apps.identrust.com",
"appsforoffice.microsoft.com",
"assets.onestore.ms",
"attachments.office.net",
"aus.delve.office.com",
"auth.gfx.ms",
"autologon.microsoftazuread-sso.com",
"az416426.vo.msecnd.net",
"az826701.vo.msecnd.net",
"becws.microsoftonline.com",
"bit.ly",
"broadcast.officeapps.live.com",
"broadcast.skype.com",
"by.uservoice.com",
"c.bing.com",
"c.bing.net",
"c.live.com",
"c1.microsoft.com",
"cacert.a.omniroot.com",
"cacert.omniroot.com",
"cacerts.digicert.com",
"can.delve.office.com",
"ccs.login.microsoftonline.com",
"cdn.odc.officeapps.live.com",
"cdn.onenote.net",
"cdn.optimizely.com",
"cdn.sharepointonline.com",
"cdp1.public-trust.com",
"cert.int-x3.letsencrypt.org",
"cl2.apple.com",
"click.email.microsoftonline.com",
"client.hip.live.com",
"clientconfig.microsoftonline-p.net",
"companymanager.microsoftonline.com",
"compass-ssl.microsoft.com",
"config.office.com",
"connect.facebook.net",
"contentstorage.osi.office.net",
"crl.entrust.net",
"crl.globalsign.com",
"crl.globalsign.net",
"crl.identrust.com",
"crl.microsoft.com",
"crl3.digicert.com",
"crl4.digicert.com",
"cus-000.tasks.osi.office.net",
"d.docs.live.net",
"data.flurry.com",
"dc.applicationinsights.microsoft.com",
"dc.services.visualstudio.com",
"delve-gcc.office.com",
"delve.office.com",
"device.login.microsoftonline.com",
"dgps.support.microsoft.com",
"directory.services.live.com",
"docs.live.net",
"docs.microsoft.com",
"ea-000.forms.osi.office.net",
"ea-000.tasks.osi.office.net",
"ecn.dev.virtualearth.net",
"en-us.appex-rf.msn.com",
"enterpriseregistration.windows.net",
"eur.delve.office.com",
"eus-www.sway-cdn.com",
"eus-www.sway-extensions.com",
"eus-zzz.tasks.osi.office.net",
"eus2-000.forms.osi.office.net",
"evintl-aia.verisign.com",
"evintl-crl.verisign.com",
"evintl-ocsp.verisign.com",
"evsecure-aia.verisign.com",
"evsecure-crl.verisign.com",
"evsecure-ocsp.verisign.com",
"excel.officeapps.live.com",
"excelbingmap.firstpartyapps.oaspapps.com",
"excelcs.officeapps.live.com",
"firstpartyapps.oaspapps.com",
"foodanddrink.services.appex.bing.com",
"forms.microsoft.com",
"forms.office.com",
"g.live.com",
"gbr.delve.office.com",
"go.microsoft.com",
"graph.facebook.com",
"graph.microsoft.com",
"graph.windows.net",
"hip.microsoftonline-p.net",
"hipservice.microsoftonline.com",
"home.office.com",
"ind.delve.office.com",
"informationprotection.hosting.portal.azure.net",
"insertmedia.bing.office.net",
"isrg.trustid.ocsp.identrust.com",
"jpn.delve.office.com",
"kor.delve.office.com",
"lam.delve.office.com",
"login-us.microsoftonline.com",
"login.live.com",
"login.microsoft.com",
"login.microsoftonline-p.com",
"login.microsoftonline.com",
"login.windows-ppe.net",
"login.windows.net",
"logincert.microsoftonline.com",
"loginex.microsoftonline.com",
"loki.delve-gcc.office.com",
"loki.delve.office.com",
"lpcres.delve.office.com",
"m.facebook.com",
"mail.google.com",
"manage.office.com",
"management.azure.com",
"mem.gfx.ms",
"mlccdn.blob.core.windows.net",
"mlccdnprod.azureedge.net",
"mrodevicemgr.officeapps.live.com",
"ms.tific.com",
"mscrl.microsoft.com",
"msdn.microsoft.com",
"nam.delve.office.com",
"neu-000.forms.osi.office.net",
"neu-000.tasks.osi.office.net",
"nexus.microsoftonline-p.com",
"nexus.officeapps.live.com",
"nexusrules.officeapps.live.com",
"nps.onyx.azure.net",
"o15.officeredir.microsoft.com",
"ocos-office365-s2s.msedge.net",
"ocsa.officeapps.live.com",
"ocsp.digicert.com",
"ocsp.entrust.net",
"ocsp.globalsign.com",
"ocsp.int-x3.letsencrypt.org",
"ocsp.msocsp.com",
"ocsp.omniroot.com",
"ocsp2.globalsign.com",
"ocspx.digicert.com",
"ocsredir.officeapps.live.com",
"ocws.officeapps.live.com",
"odc.officeapps.live.com",
"odcsm.officeapps.live.com",
"office.live.com",
"office.microsoft.com",
"office15client.microsoft.com",
"office365servicehealthcommunications.cloudapp.net",
"officeapps.live.com",
"officecdn.microsoft.com",
"officecdn.microsoft.com.edgesuite.net",
"officeclient.microsoft.com",
"officeimg.vo.msecnd.net",
"officepreviewredir.microsoft.com",
"officeredir.microsoft.com",
"officespeech.platform.bing.com",
"ols.officeapps.live.com",
"omextemplates.content.office.net",
"oneclient.sfx.ms",
"onenote.officeapps.live.com",
"outlook.office.com",
"outlook.office365.com",
"outlook.uservoice.com",
"p100-sandbox.itunes.apple.com",
"partnerservices.getmicrosoftkey.com",
"passwordreset.microsoftonline.com",
"peoplegraph.firstpartyapps.oaspapps.com",
"platform.linkedin.com",
"play.google.com",
"policykeyservice.dc.ad.msft.net",
"portal.microsoftonline.com",
"portal.office.com",
"powerpoint.officeapps.live.com",
"pptcs.officeapps.live.com",
"privatecdn.sharepointonline.com",
"prod.firstpartyapps.oaspapps.com.akadns.net",
"prod.msocdn.com",
"products.office.com",
"protection.office.com",
"provisioningapi.microsoftonline.com",
"publiccdn.sharepointonline.com",
"quicktips.skypeforbusiness.com",
"r.office.microsoft.com",
"r1.res.office365.com",
"r3.res.office365.com",
"r3.res.outlook.com",
"r4.res.office365.com",
"res.delve.office.com",
"rink.hockeyapp.net",
"roaming.officeapps.live.com",
"rtc.officeapps.live.com",
"s.ytimg.com",
"s0.assets-yammer.com",
"s1.symcb.com",
"s2.symcb.com",
"sa.symcb.com",
"sas.office.microsoft.com",
"scsinstrument-ss-us.trafficmanager.net",
"scsquery-ss-asia.trafficmanager.net",
"scsquery-ss-eu.trafficmanager.net",
"scsquery-ss-us.trafficmanager.net",
"sd.symcb.com",
"sdk.hockeyapp.net",
"sea-000.tasks.osi.office.net",
"secure.aadcdn.microsoftonline-p.com",
"secure.globalsign.com",
"secure.meetup.com",
"securescore.office.com",
"shared.officeapps.live.com",
"shellprod.msocdn.com",
"signup.live.com",
"signup.microsoft.com",
"skydrive.wns.windows.com",
"skypemaprdsitus.trafficmanager.net",
"smtp.office365.com",
"social.yahooapis.com",
"spoprod-a.akamaihd.net",
"sr.symcb.com",
"sr.symcd.com",
"ssw.live.com",
"staffhub.ms",
"staffhub.office.com",
"staffhub.uservoice.com",
"staffhubweb.azureedge.net",
"static.sharepointonline.com",
"storage.live.com",
"store.office.com",
"su.symcb.com",
"su.symcd.com",
"suite.office.net",
"support.content.office.net",
"support.microsoft.com",
"support.office.com",
"sway.com",
"sway.office.com",
"tasks.office.com",
"teams.microsoft.com",
"technet.microsoft.com",
"telemetryservice.firstpartyapps.oaspapps.com",
"templates.office.com",
"templateservice.office.com",
"testconnectivity.microsoft.com",
"tse1.mm.bing.net",
"uci.officeapps.live.com",
"vassg142.crl.omniroot.com",
"vassg142.ocsp.omniroot.com",
"video.osi.office.net",
"videocontent.osi.office.net",
"videoplayercdn.osi.office.net",
"view.atdmt.com",
"view.officeapps.live.com",
"visio.officeapps.live.com",
"vortex.data.microsoft.com",
"watson.microsoft.com",
"watson.telemetry.microsoft.com",
"weather.tile.appex.bing.com",
"web.localytics.com",
"web.microsoftstream.com",
"webanalytics.localytics.com",
"webshell.suite.office.com",
"weu-000.forms.osi.office.net",
"weu-000.tasks.osi.office.net",
"wikipedia.firstpartyapps.oaspapps.com",
"word-edit.officeapps.live.com",
"word-view.officeapps.live.com",
"wordcs.officeapps.live.com",
"wu.client.hip.live.com",
"wus-000.forms.osi.office.net",
"wus-000.tasks.osi.office.net",
"wus-firstpartyapps.oaspapps.com",
"wus-www.sway-cdn.com",
"wus-www.sway-extensions.com",
"www.acompli.com",
"www.bing.com",
"www.digicert.com",
"www.dropbox.com",
"www.evernote.com",
"www.google-analytics.com",
"www.googleapis.com",
"www.microsoft.com",
"www.office.com",
"www.onedrive.com",
"www.outlook.com",
"www.sway.com",
"www.wunderlist.com",
"www.youtube.com"
],
"matching_attributes": [
"domain",
"domain|ip",
"hostname"
],
"name": "List of known Office 365 URLs",
"type": "substring",
"version": 20190310
}