ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hypothesis targets the presence of Evilginx indicators, a phishing-as-a-service platform frequently used by adversaries to intercept multi-factor authentication tokens and hijack user sessions. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised identities before attackers leverage stolen credentials to establish persistent access or move laterally within the environment.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["198.199.82.231", "144.126.218.78"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["198.199.82.231", "144.126.218.78"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

• Scenario: Phishing Simulation or Security Awareness Training

  • Description: Security teams often deploy phishing simulations using platforms like GoPhish or KnowBe4. These tools may use custom domains or IP ranges that overlap with known Evilginx infrastructure to test user susceptibility, or the simulation dashboard itself might be hosted on a CDN IP that matches an IOC.
  • Filter/Exclusion: Exclude source IPs belonging to the internal Phishing Simulation platform (e.g., 10.20.5.10 for GoPhish) or exclude user agents containing phishing-sim or security-awareness in the HTTP request headers.

• Scenario: Legacy Application or Vendor Portal Access

  • Description: A third-party vendor (e.g., a cloud service provider or SaaS tool) may host their login portal or API endpoint on an IP address or domain that was previously used by Evilginx or is part of a shared hosting provider. Legitimate users accessing this vendor portal will trigger the IOC match.
  • Filter/Exclusion: Create an allowlist for specific vendor domains (e.g., *.vendorportal.com) or specific IP ranges associated with known SaaS providers (e.g., 52.96.0.0/16 for AWS us-east-1) if they are confirmed legitimate sources of traffic.

• Scenario: Scheduled Backup or Sync Jobs

  • Description: Automated backup agents (e.g., Veeam, Commvault) or file sync services (e.g., Synology, rsync) may connect to remote storage endpoints or management consoles that reside on IP addresses matching the Evilginx IOCs. These connections are typically initiated by service accounts or system processes, not user browsers.
  • Filter/Exclusion: Exclude traffic where the source process name is a known backup