ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt detects adversary behavior where Evilginx leverages man-in-the-middle attacks on compromised infrastructure to intercept user credentials through sophisticated phishing campaigns. A proactive search in Azure Sentinel is critical because this toolkit’s ability to bypass standard multi-factor authentication by mimicking legitimate login flows requires early identification of anomalous network traffic and redirection patterns to prevent credential theft.

IOC Summary

Malware Family: Evilginx Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`185[.]212[.]128[.]168:9000`	botnet_cc	2026-09-02	75%
ip:port	`162[.]35[.]161[.]206:2850`	botnet_cc	2026-09-02	75%
ip:port	`158[.]69[.]213[.]104:443`	botnet_cc	2026-09-02	75%
ip:port	`153[.]75[.]235[.]15:2850`	botnet_cc	2026-09-02	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["158.69.213.104", "153.75.235.15", "185.212.128.168", "162.35.161.206"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["158.69.213.104", "153.75.235.15", "185.212.128.168", "162.35.161.206"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Evilginx

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Evilginx IOCs rule, tailored for an enterprise environment, along with suggested filters and exclusions:

Scenario: Legitimate Cloud Identity Federation Traffic
- Context: Enterprise Single Sign-On (SSO) solutions like Okta, Azure AD, or Ping Identity frequently utilize complex redirect chains and proxy mechanisms that mimic the “man-in-the-middle” behavior of Evilginx. When users authenticate via these platforms, traffic often traverses intermediate nodes that could be flagged as suspicious redirections.
- Filter/Exclusion: Exclude network flows where the destination IP belongs to known SaaS provider ranges (e.g., okta.com, login.microsoftonline.com) and the HTTP status codes are standard 302 redirects followed by a successful 200 OK. Additionally, whitelist specific User-Agent strings associated with enterprise browser extensions used for MFA.
Scenario: Scheduled Backup and Sync Operations
- Context: Automated backup agents such as Veeam, Rubrik, or Carbonite often perform scheduled jobs that involve downloading large payloads from external repositories. These tools may initiate connections to temporary storage buckets or CDN nodes that share infrastructure characteristics with Evilginx hosting environments, triggering alerts on “unusual traffic volume” and redirection patterns.
- Filter/Exclusion: Create a time-based exclusion for known backup windows (e.g., 02:00–04:00 UTC) on specific service accounts (e.g., svc_backup_01). Filter out alerts where the source process is identified as the specific backup agent binary and the destination domain matches the organization’s approved cloud storage list.
Scenario: Corporate Web Proxy and Content Filtering
- Context: Enterprise-wide web security gateways like **Zsc