ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt detects adversary behavior where attackers leverage Evilginx’s sophisticated phishing infrastructure to bypass multi-factor authentication and steal session tokens through real-time proxying of user interactions. A SOC team should proactively hunt for these specific IOCs in Azure Sentinel because Evilginx attacks often evade traditional detection by mimicking legitimate traffic, requiring active investigation to prevent unauthorized access before credentials are fully compromised.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["144.217.94.115", "172.86.119.225"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["144.217.94.115", "172.86.119.225"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Phishing Simulation Campaigns

  • Context: Security teams frequently use tools like KnowBe4, Proofpoint, or GoPhish to run automated phishing simulations. These campaigns often utilize landing pages hosted on the same cloud infrastructure (e.g., AWS, Azure) or specific DNS prefixes that overlap with Evilginx indicators. The simulation traffic may hit a known IOCs domain used by the threat actor for legitimate campaign tracking.
  • Filter/Exclusion: Create an exclusion rule based on the source user group Security_Ops_Team and destination IP ranges associated with your internal phishing platform (e.g., phishing-sim.internal.corp). Alternatively, exclude traffic where the HTTP User-Agent string contains specific simulation identifiers like GoPhish-Simulation or Proofpoint-Test.

• Scenario: Automated Cloud Backup and Sync Jobs

  • Context: Enterprise data backup solutions such as Veeam, Rubrik, or Microsoft OneDrive for Business often sync large datasets to external cloud repositories. If the Evilginx IOCs include a generic CDN domain (e.g., azureedge.net or a specific AWS S3 bucket) used by these backup tools, the high-volume data transfer triggers the rule as suspicious activity resembling Evilginx’s proxy behavior.
  • Filter/Exclusion: Implement an exclusion for scheduled tasks running during off-hours (e.g., 01:00–05:00 local time) originating from specific service accounts like svc-veeam-backup or svc-onedrive-sync. Add a filter to exclude traffic where the destination port is strictly 443