ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt identifies potential Evilginx phishing infrastructure by correlating known IOCs with network traffic and endpoint logs to detect credential harvesting sessions. Proactively hunting for these indicators is critical because Evilginx enables real-time man-in-the-middle attacks that bypass MFA, allowing adversaries to steal session tokens and gain persistent access to user accounts.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["94.183.235.121", "159.198.32.64"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.183.235.121", "159.198.32.64"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

• Phishing Campaign Cleanup by Security Team: When the SOC team performs a post-incident review or cleanup for a phishing campaign, they may intentionally open or reference the specific Evilginx IOCs (e.g., evilginx.io or specific subdomains) in their ticketing system, email threads, or browser history to verify the threat context.

  • Filter: Exclude alerts where the user belongs to the Security-Operations or SOC-Team AD group, or where the source process is a known browser (e.g., chrome.exe, msedge.exe) and the destination URL contains the IOC string in the query parameters or path (indicating a manual check rather than a connection).

• IT Admin Testing New Phishing Simulation Tools: IT administrators or security engineers often test new phishing simulation platforms (like GoPhish or KnowBe4) that may use similar domain structures or reference Evilginx as a benchmark in their configuration files or test scripts.

  • Filter: Exclude alerts originating from service accounts used for automation (e.g., svc-phishing-test) or where the source machine is in the Dev-Test or Lab OU, and the activity occurs during business hours on non-production workstations.

• Scheduled Backup or Log Rotation Jobs: Some log management or backup solutions (e.g., Veeam, Commvault) may archive or index files containing threat intelligence feeds that include Evilginx IOCs. If the detection rule triggers on file content or metadata rather than active connections, these jobs can cause false positives.

  • Filter: Exclude alerts where the source process is a known backup or log management agent (e.g., veeam.exe, commvault.exe) and the event type is “File Created” or “File Modified” rather than “Network Connection” or “Process Started”.

• **Developer Debugging Threat Intelligence