Mubix (@mubix) used the subdomains list from here to bruteforce subdomains using dig and args. Really nice use of xargs for parallel execution.
1
2
cat subdomains.txt | \
xargs -P 122 -I subdomain dig +noall subdomain.microsoft.com +answer
–Jason