Observable:
msMaliciousIps20260518.txt (7.6 KB)
Observable Type: IP Addresses
Admiralty: B2
Details: These IPs were observed in an M365 tenant and associated logins were specifically blocked by Microsoft “because it came from an IP address with malicious activity.” It’s a good start to hunt for more related IPs / clusters.
Whaddaya think: MISP it?
I think it’s reliable enough to do it. My understanding is MS is very conservative with their block listing since that blocks across all tenants. I hadn’t paid attention during the MISPification process. Is that something for you to do or me?
Me and a handful of other staffers for now!
I don’t know whether to laugh or be terrified. I grabbed your list, converted it to a CSV and threw it into a query (see below) and got nine hits over the past week. Looking at the devices used they were all iPhones and only one was not Azure AD registered. Either we have a big security issue (well let’s be honest, we’re allowing Azure AD registered devices to run consumer VPNs…) or MS hasn’t bother to separate the wheat from the chafe. Then again, that’s what I was hired to do lol.
(Edit: And yes, I know they are dynamic IPs. This was just a good chuckle.)
EntraIdSignInEvents
| where IPAddress has_any (msMaliciousIps20260518)
| where ErrorCode == “0”