ThreatFox: Evilginx IOCs

Hunt Hypothesis

This detection rule identifies adversary activity leveraging Evilginx’s advanced man-in-the-middle phishing capabilities to intercept and manipulate multi-factor authentication sessions. A proactive hunt is essential within Azure Sentinel to uncover stealthy credential theft attacks that bypass traditional MFA defenses by analyzing real-time traffic against known Evilginx indicators of compromise.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["198.135.54.91", "185.212.128.51"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.135.54.91", "185.212.128.51"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are the documented false positive scenarios for the ThreatFox: Evilginx IOCs detection rule, including specific contexts and recommended filters:

• Scenario: Scheduled Cloud Backup Synchronization

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often perform nightly synchronization jobs that establish outbound HTTPS connections to cloud storage endpoints (e.g., AWS S3, Azure Blob). If the Evilginx IOCs include generic IP ranges or domains shared by these cloud providers, the rule may trigger during the scheduled backup window.
  • Filter/Exclusion: Create a time-based exclusion for the specific source hosts (Backup Servers) running between 01:00 and 05:00 local time on weekdays. Alternatively, add the destination IP ranges of the cloud storage providers to the rule’s allow-list if they are confirmed as benign in this context.

• Scenario: Automated Software Patching via WSUS/SCCM

  • Context: The Microsoft Endpoint Configuration Manager (MECM/SCCM) or Windows Server Update Services (WSUS) servers frequently initiate outbound connections to Microsoft update repositories and third-party vendor portals (e.g., Adobe, Oracle) to download patches. These connections often traverse through shared CDN nodes that may overlap with Evilginx IOCs.
  • Filter/Exclusion: Exclude traffic originating from the specific SCCM Site System Servers where the destination domain matches known Microsoft or major software vendor update domains (e.g., *.update.microsoft.com). Implement a filter based on the User-Agent string containing “Microsoft-Update” to distinguish patching traffic from user browser sessions.

• Scenario: Enterprise SSO and Identity Federation Traffic

  • Context: In environments using Okta, Azure Active Directory (Entra ID), or Ping Identity, users frequently access internal applications