id: azure-takeover-detection

info:
  name: Azure takeover detection
  author: pdteam
  severity: high
  tags: dns,takeover

  # Update the list with more CNAMEs related to azure
  # You need to claim the CNAME in Azure portal (https://portal.azure.com) to confirm the takeover.
  # Reference:- https://godiego.tech/posts/STO/, kudos to @secfaults for sharing process details.
  # Do not report this without claiming the CNAME.


dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 3
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "azure-api.net"
          - "azure-mobile.net"
          - "azurecontainer.io"
          - "azurecr.io"
          - "azuredatalakestore.net"
          - "azureedge.net"
          - "azurefd.net"
          - "azurehdinsight.net"
          - "azurewebsites.net"
          - "azurewebsites.windows.net"
          - "blob.core.windows.net"
          - "cloudapp.azure.com"
          - "cloudapp.net"
          - "database.windows.net"
          - "redis.cache.windows.net"
          - "search.windows.net"
          - "servicebus.windows.net"
          - "trafficmanager.net"
          - "visualstudio.com"
      - type: word
        words:
          - "NXDOMAIN"