Finding all things on-prem Microsoft for password spraying and enumeration.
The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft solutions.
Link: https://github.com/puzzlepeaches/msprobe