id: azure-takeover-detection

info:
  name: Azure takeover detection
  author: pdteam
  severity: high
  tags: dns,takeover
  reference:
    - https://godiego.tech/posts/STO/ # kudos to @secfaults for sharing process details.

# Update the list with more CNAMEs related to Azure
# You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover.
# Do not report this without claiming the CNAME.

dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 3
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "azure-api.net"
          - "azure-mobile.net"
          - "azurecontainer.io"
          - "azurecr.io"
          - "azuredatalakestore.net"
          - "azureedge.net"
          - "azurefd.net"
          - "azurehdinsight.net"
          - "azurewebsites.net"
          - "azurewebsites.windows.net"
          - "blob.core.windows.net"
          - "cloudapp.azure.com"
          - "cloudapp.net"
          - "database.windows.net"
          - "redis.cache.windows.net"
          - "search.windows.net"
          - "servicebus.windows.net"
          - "trafficmanager.net"
          - "visualstudio.com"
      - type: word
        words:
          - "NXDOMAIN"

    extractors:
      - type: regex
        group: 1
        regex:
          - "IN\tCNAME\t(.+)"