ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt identifies network traffic or host activity matching known indicators of compromise associated with Evilginx, a phishing framework frequently used to intercept multi-factor authentication credentials. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to detect potential credential theft attempts and isolate affected assets before adversaries can leverage stolen sessions to escalate privileges or move laterally within the environment.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["5.175.188.199", "86.54.29.65"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.175.188.199", "86.54.29.65"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

• Legacy Phishing Simulation Campaigns: Security teams often use tools like GoPhish or Gophish to run internal phishing simulations that mimic Evilginx-style credential harvesting pages. If the simulation infrastructure (e.g., a specific phishing.simdomain.com or internal IP) is not whitelisted, the IOC hunt will flag these legitimate test events.

  • Filter/Exclusion: Exclude source IPs or hostnames associated with the internal phishing simulation platform (e.g., *.gophish.local, phishing-sim.corp.net) or specific user groups designated as “Phishing Test Participants.”

• DevOps/CI-CD Pipeline Credential Testing: In development environments, engineers may use Evilginx or similar proxy tools to test SSO flows, OAuth redirects, or MFA bypass scenarios in staging environments. These tests often generate traffic matching Evilginx IOCs (such as specific User-Agent strings or TLS certificate fingerprints) but are confined to non-production networks.

  • Filter/Exclusion: Exclude events where the source or destination host is tagged with environment labels such as env=staging, env=dev, or team=platform-engineering, or exclude specific container images known to run proxy testing tools.

• Third-Party Vendor Onboarding/Migration: During vendor onboarding or cloud migration projects, external partners may use temporary Evilginx instances to validate SAML/OIDC integrations before full deployment. These temporary setups often use public IPs or domains that match the IOC list but are part of a documented change request.

  • Filter/Exclusion: Correlate with CMDB or ticketing system data; exclude events where the source IP or domain is listed in an active “Vendor Integration” ticket or tagged in the asset inventory as vendor-integration=true for the duration of the project.

• **Internal Load Balancer/Reverse