This hypothesis targets the presence of known Evilginx indicators of compromise, which signal that an adversary is actively deploying a phishing toolkit to intercept user credentials through spoofed login pages. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised identities early, thereby preventing lateral movement and persistent access resulting from stolen credentials.
Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 162[.]35[.]107[.]168:8080 | botnet_cc | 2026-09-13 | 75% |
| ip:port | 144[.]172[.]106[.]62:8443 | botnet_cc | 2026-09-13 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["162.35.107.168", "144.172.106.62"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["162.35.107.168", "144.172.106.62"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate Phishing Simulation Campaigns: Security teams often use tools like GoPhish or custom Evilginx instances to test employee awareness. These simulations intentionally mimic login pages (e.g., Microsoft 365, Okta) and may generate traffic patterns or IOCs that match known Evilginx signatures.
phish-sim.internal.corp) or tag alerts where the user agent or referrer header indicates a known simulation tool.CDN or Reverse Proxy Caching of Login Pages: In large enterprises, public-facing login portals (e.g., customer portals, partner sites) are often served through CDNs (like Cloudflare or Akamai) or reverse proxies (like Nginx/HAProxy). If the CDN’s edge nodes or proxy servers have cached or are serving static assets that resemble Evilginx templates, or if their IP ranges overlap with known Evilginx infrastructure, they may trigger false positives.
10.20.0.0/24) from the IOC match, unless the alert includes additional context like unusual TLS fingerprints.Developer or QA Environments Mimicking Production: Development and QA teams frequently spin up local or staging environments that replicate production login flows, including custom JavaScript or HTML structures that may accidentally match Evilginx IOCs (e.g., specific form field names, hidden inputs, or script patterns). These environments are often accessible via internal DNS or test subdomains.
*.dev.corp, `*.qa.cor