ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt detects adversary activity involving Evilginx’s advanced phishing infrastructure by identifying specific indicators of compromise that facilitate credential theft and session hijacking. A SOC team should proactively search for these IOCs in Azure Sentinel to rapidly identify and contain sophisticated attacks that bypass traditional multi-factor authentication defenses before sensitive data is exfiltrated.

IOC Summary

Malware Family: Evilginx Total IOCs: 3 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["185.212.129.129", "94.20.141.82"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.212.129.129", "94.20.141.82"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Evilginx
let malicious_urls = dynamic(["http://bx.varrysections.digital/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Security Tool Updates via Cloud Repositories

  • Context: Enterprise endpoints (e.g., Windows 10/11) or servers running Microsoft Defender for Endpoint or CrowdStrike Falcon automatically query their respective update servers. These repositories often utilize dynamic DNS entries and IP ranges that may overlap with the Evilginx IOC set, triggering alerts when agents fetch definition updates or policy changes during maintenance windows (e.g., 2:00 AM daily).
  • Suggested Filter/Exclusion: Create a rule exclusion based on the specific Process Name (MsMpEng.exe, FalconSensorService) and restrict the alert to only trigger if the destination IP is not within the known Microsoft Azure CDN or CrowdStrike Update Server CIDR blocks. Alternatively, add these specific update server domains (e.g., *.microsoft.com, *.falcon.crowdstrike.com) to a global allow-list for this rule.

• Scenario: Admin-Driven Cloud Backup and Synchronization Tasks

  • Context: IT administrators utilize tools like Veeam Backup & Replication, Rubrik, or Microsoft OneDrive/SharePoint Sync Client to perform large-scale data transfers to cloud storage. These services frequently connect to backend gateways that share IP addresses with the Evilginx infrastructure, causing false positives during nightly backup jobs or when users manually trigger a “Sync Now” action on critical files.
  • Suggested Filter/Exclusion: Implement an exclusion based on the User Account (e.g., DOMAIN\BackupServiceAccount, DOMAIN\OneDriveAdmin) and the Process Path. Configure the rule to