ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving Evilginx-managed infrastructure by identifying traffic to specific Indicators of Compromise known to support advanced phishing and credential harvesting campaigns. Proactively hunting for these IOCs within Azure Sentinel is critical because Evilginx’s ability to bypass traditional MFA protections makes early detection essential for preventing widespread account compromise before lateral movement occurs.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["74.0.32.137", "100.31.133.28"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["74.0.32.137", "100.31.133.28"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Legitimate Phishing Campaigns by Internal Security Teams

  • Scenario: The internal Security Awareness team uses tools like Proofpoint or KnowBe4 to deploy simulated phishing campaigns. These simulations often utilize dynamic DNS infrastructure that shares IP ranges or domain patterns with known Evilginx IOCs, particularly when the simulation mimics a “Microsoft 365” login flow.
  • Filter/Exclusion: Create an exclusion for traffic originating from internal security workstations (e.g., src_ip in 10.x.x.x/24) or specifically whitelist the IP ranges and domains associated with your organization’s approved phishing simulation vendors.

• Scheduled Cloud Identity Provisioning Jobs

  • Scenario: Automated identity management workflows using Microsoft Entra ID (Azure AD) or Okta trigger scheduled jobs to synchronize user attributes or reset credentials. These background processes may initiate connections to external Microsoft authentication endpoints that overlap with Evilginx IOCs, especially during off-hours maintenance windows.
  • Filter/Exclusion: Exclude traffic generated by specific service accounts (e.g., svc-identity-sync, okta-agent) running on dedicated jump servers or cloud VMs. Additionally, filter for the specific user agent strings associated with these provisioning tools (e.g., containing “Microsoft-Azure-AD-Sync” or “Okta-Agent”).

• Third-Party SaaS Integration Health Checks

  • Scenario: Enterprise Service Desk platforms like ServiceNow, Jira, or Salesforce perform routine health checks and API polling against external identity providers. If the organization uses a hybrid cloud setup, these integrations may route traffic through shared CDN nodes that host Evilgin