Known benign platformlowbenign
Microsoft Attack Simulation Training
family: microsoft-attack-simulator
Short link:scanmalware.com/h/143
Microsoft Defender for O365 "Attack simulation training" — Microsoft-owned decoy domains serving Microsoft-branded login pages for phishing-awareness testing. Benign; tracked for inventory only. The whole fleet shares one TLS certificate (issuer Microsoft Corporation, CN www.attemplate.com, 131 SANs), which is how it is tracked.
Anchors
SMQL queryrun
url:*/login?id=* AND nameserver:*azure-dns*