ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage Evilginx’s advanced phishing infrastructure to deploy sophisticated multi-factor authentication (MFA) bypass attacks using three specific indicators of compromise. The SOC team should proactively search for these IOCs in Azure Sentinel to detect early-stage credential theft attempts that evade traditional signature-based defenses, ensuring rapid containment before lateral movement occurs.

IOC Summary

Malware Family: Evilginx Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`213[.]160[.]77[.]221:443`	botnet_cc	2026-07-19	75%
ip:port	`159[.]65[.]232[.]209:8080`	botnet_cc	2026-07-19	75%
ip:port	`157[.]230[.]235[.]215:8080`	botnet_cc	2026-07-19	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["159.65.232.209", "213.160.77.221", "157.230.235.215"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["159.65.232.209", "213.160.77.221", "157.230.235.215"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Evilginx

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

Internal Phishing Simulation Campaigns
- Scenario: The Security Awareness team uses tools like KnowBe4, Proofpoint, or Microsoft Defender for Office 365 to run quarterly phishing simulations. These platforms often utilize dynamic DNS resolution and load-balanced infrastructure that shares IP ranges with known Evilginx C2 servers. When employees click links in these simulated emails, the EDR or Proxy logs may match against the shared IOCs.
- Filter/Exclusion: Create an exclusion rule for traffic originating from internal mail gateways (e.g., Source_IP = Office 365 Tenant ID) or specifically whitelist the IP ranges and FQDNs used by your organization’s designated phishing simulation vendor.
Automated Vulnerability Scanning Probes
- Scenario: Scheduled vulnerability assessments using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM actively probe external endpoints to verify certificate validity and service availability. These scanners frequently resolve and connect to public DNS resolvers and CDN nodes that overlap with Evilginx infrastructure, particularly when scanning for SSL/TLS misconfigurations on web-facing assets.
- Filter/Exclusion: Exclude network flows where the Process_Name matches known scanner executables (e.g., TenableAgent.exe, qualys_daemon) and the destination port is restricted to standard HTTP/HTTPS (80, 443) during defined maintenance windows.
Software Update Distribution via Content Delivery Networks
- Scenario: Enterprise patch management systems like Microsoft Endpoint Configuration Manager (MECM), Ivanti, or Jamf Pro pull update manifests and binaries