ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt detects adversary activity where attackers leverage Evilginx’s advanced man-in-the-middle infrastructure to intercept and manipulate user authentication sessions across multiple protocols. Proactively hunting for these specific IOCs in Azure Sentinel is critical because it enables the SOC team to identify sophisticated credential theft campaigns that often bypass traditional static signature-based defenses by mimicking legitimate traffic patterns.

IOC Summary

Malware Family: Evilginx Total IOCs: 3 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["185.212.128.231", "107.173.160.177", "185.212.128.139"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.212.128.231", "107.173.160.177", "185.212.128.139"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Security Operations Center (SOC) Threat Hunting Exercises

  • Scenario: During scheduled threat hunting drills, analysts manually inject known Evilginx indicators (such as evilginx2.com or specific TLS JA3 fingerprints) into the SIEM to validate detection coverage. These controlled tests generate alerts that mimic real attacks but are part of routine validation workflows using tools like Splunk ad-hoc queries or Microsoft Sentinel playbooks.
  • Suggested Filter: Exclude events where the Source field is tagged as “Test” or “Validation,” or filter by a specific User_ID associated with the SOC team (e.g., user_id = soc_hunter_group) and restrict alerts to business hours when drills are typically conducted.

• Automated Phishing Simulation Campaigns

  • Scenario: The organization utilizes platforms like KnowBe4, Proofpoint, or Microsoft Defender for Office 365 to run monthly phishing simulations. These tools often utilize Evilginx-specific IOCs (such as specific redirect chains or certificate attributes) within their simulation templates to train users on advanced credential harvesting, triggering the rule when employees click simulated links.
  • Suggested Filter: Create an exclusion for traffic originating from the IP ranges of the phishing simulation vendor’s infrastructure. Additionally, filter out events where the Destination_URL contains known simulation subdomains (e.g., *.simulations.knowbe4.com) or matches a specific Campaign_ID metadata tag used by the security awareness team.

• Endpoint Detection and Response (EDR) Scheduled Scans

  • Scenario: Enterprise EDR solutions like CrowdStrike Falcon, SentinelOne,