Hi all,
we have some Microsoft packets coming form MS ISP IP addresses on HTTPS.
Those packets are originated by MS services for authentication purposes.
They are proxied through our firewall and forwarded to our onpremise federated auth infrastructure in dmz.
We receive both legitimate auth requests and brute force attacks.
The source IP addresses are ever trusted MS IPs and can not be filtered or dropped.
We would know if there is a way to enable https inspection inbound , parsing the content (the IP addreess inside the message) based on a list of IPs that we knows as malicius and we collect in other ways end finally prevent the packet from reaching the auth infrastructure
Only the checkpoint IPS IPs reputation may be not enough for us
(for now Microsoft says there is no ways for them to block those request......)
Many thanks 🙂
Rui
