ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt detects adversary activity involving Evilginx phishing campaigns that utilize advanced session token hijacking to bypass multi-factor authentication and gain unauthorized access to sensitive accounts. The SOC team should proactively search for these specific IOCs within Azure Sentinel because Evilginx’s sophisticated attack vector often evades traditional email filtering, requiring real-time detection of compromised credentials before lateral movement occurs.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["204.152.217.122", "45.61.177.135"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["204.152.217.122", "45.61.177.135"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Security Scans by EDR Agents

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often perform scheduled network scans or telemetry uploads. These agents may communicate with known threat intelligence feeds that share IP ranges or domain patterns with Evilginx infrastructure, triggering a match on the IOC list.
  • Filter/Exclusion: Create an exclusion rule based on the Process Name and Parent Process. Exclude traffic where process_name matches FalconSensor.exe, MsMpEng.exe, or cb.sysmon AND parent_process_name is a known service account (e.g., SYSTEM or NT SERVICE\...). Additionally, exclude specific IP ranges belonging to the EDR vendor’s cloud telemetry endpoints.

• Scenario: Automated Cloud Backup and Sync Operations

  • Context: Scheduled backup jobs utilizing tools like Veeam, Rubrik, or Microsoft 365 Compliance Center often connect to external storage gateways or synchronization services. If the Evilginx IOC list includes generic cloud provider subdomains (e.g., *.cloudflare.com or specific AWS/Azure egress IPs) that overlap with backup destinations, legitimate sync traffic will trigger alerts.
  • Filter/Exclusion: Implement a time-based exclusion for known maintenance windows. Configure the rule to ignore events where source_ip belongs to the internal backup subnet (e.g., 10.20.50.0/24) AND the destination domain matches approved backup service domains (e.g., backup.rubrik.com, veeam.net).