ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage Evilginx’s advanced phishing infrastructure to execute credential harvesting campaigns that bypass traditional MFA protections. Proactively hunting these specific IOCs in Azure Sentinel is critical for early detection of compromised identities before lateral movement occurs within the tenant environment.

IOC Summary

Malware Family: Evilginx Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`68[.]183[.]36[.]161:8080`	botnet_cc	2026-07-09	75%
ip:port	`173[.]249[.]22[.]152:443`	botnet_cc	2026-07-09	75%
ip:port	`157[.]173[.]195[.]214:443`	botnet_cc	2026-07-09	75%
ip:port	`157[.]173[.]195[.]214:8443`	botnet_cc	2026-07-09	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["157.173.195.214", "173.249.22.152", "68.183.36.161"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["157.173.195.214", "173.249.22.152", "68.183.36.161"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Evilginx

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule in an enterprise environment, along with recommended filters and exclusions:

Corporate Email Gateway Phishing Campaigns
- Scenario: The IT Security team or Marketing department utilizes a dedicated phishing simulation platform (e.g., KnowBe4, Proofpoint, or Microsoft Defender for Office 365) to run internal training campaigns. These platforms often host landing pages that mimic legitimate corporate login portals, generating traffic patterns and URL structures that overlap with Evilginx’s “clone” behavior indicators.
- Filter/Exclusion: Create an exclusion rule for the specific IP ranges of the phishing simulation vendor and whitelist known campaign domains (e.g., *.knowbe4.com, *.proofpoint.com) in the ThreatFox IOC feed configuration to prevent alerts on these internal training URLs.
Automated Software Update & Patch Management
- Scenario: Enterprise endpoint management tools such as Microsoft Endpoint Configuration Manager (MECM/SCCM), Ivanti, or Jamf Pro execute scheduled jobs during off-hours to push critical updates. These agents frequently connect to external update servers that may share SSL certificate attributes or redirect chains similar to the Evilginx IOCs, particularly if the update server utilizes a CDN with dynamic IP rotation.
- Filter/Exclusion: Implement a filter based on the Process Name and User Account. Exclude alerts where the initiating process is a known patching agent (e.g., ccmexec.exe, jamfagentd) running under a dedicated service account (e.g., svc-patch-mgmt), rather than an interactive user session.
Third-Party SaaS Integration & API Sync
- Scenario: Business applications like ServiceNow, Salesforce, or **