This hunt targets network connections to known Evilginx phishing infrastructure, indicating an adversary is likely conducting credential harvesting attacks to intercept user logins. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing attackers from leveraging stolen credentials for lateral movement or persistent access within the environment.
Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 34[.]122[.]131[.]42:9000 | botnet_cc | 2026-09-04 | 75% |
| ip:port | 178[.]128[.]171[.]71:3333 | botnet_cc | 2026-09-04 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["178.128.171.71", "34.122.131.42"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.128.171.71", "34.122.131.42"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A security operations team or threat intelligence platform (e.g., MISP, Cortex XSOAR) automatically ingests and distributes the latest ThreatFox Evilginx IOC list to endpoint agents for proactive scanning. This results in legitimate network connections or process executions matching the known IPs or hashes used for validation.
cortexagent.exe, misp-agent, or specific service accounts like svc-threatintel) from the detection logic, or filter out traffic originating from the internal Threat Intelligence Management (TIM) subnet.Scenario: A DevOps or Site Reliability Engineering (SRE) team is performing a controlled penetration test or red team exercise, intentionally deploying an Evilginx phishing kit in an isolated lab environment or against a specific test user group to validate detection coverage.
AD-Group: RedTeam-Lab or Tag: PenTest-Active) and exclude endpoints or users within that group from the detection rule during the scheduled test window. Alternatively, exclude specific VLANs or subnets designated for lab environments (e.g., 10.20.0.0/24).Scenario: An enterprise web proxy or DNS filtering appliance (e.g., Zscaler, Netskope, or FortiGate) is configured to block or log known malicious domains/IPs from the ThreatFox list as part of its default security policy, generating high-volume alert events that match the IOC hunt criteria.
zscalerclient.exe, netskopeagent.exe, forticlient.exe) or filter out alerts generated by specific proxy