ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Evilginx indicators of compromise, which are frequently used by adversaries to deploy phishing kits that capture session tokens and bypass multi-factor authentication. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised user sessions or active phishing infrastructure before attackers can leverage stolen credentials to escalate privileges or move laterally within the environment.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["142.93.49.30", "129.212.163.157"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["142.93.49.30", "129.212.163.157"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

• Phishing Simulation or Red Team Exercises: Security teams often deploy Evilginx instances in isolated lab environments or use it during authorized phishing simulations to test MFA fatigue or credential interception capabilities. These legitimate tests can generate network traffic or host entries matching known Evilginx IOCs.
  • Filter/Exclusion: Exclude source IPs or hostnames associated with the security lab subnet (e.g., 10.20.0.0/24) or specific test accounts (e.g., phishing-test-*) from the IOC match criteria.
• CDN or Reverse Proxy Caching: In large enterprises, Evilginx instances may be fronted by a CDN (like Cloudflare) or a reverse proxy (like Nginx) for load balancing or TLS termination. If the detection rule relies on DNS resolution or specific header fingerprints, the CDN’s IP ranges or generic proxy headers might inadvertently match the IOCs if the rule is not strictly scoped to the Evilginx-specific user-agent or path structures.
  • Filter/Exclusion: Exclude known CDN IP ranges (e.g., Cloudflare 172.67.0.0/16, 10.0.0.0/16 if internal) or filter out traffic where the X-Forwarded-For header indicates a known internal proxy, ensuring only direct connections to the Evilginx backend are alerted.
• Legacy or Staging Environments: Development or staging environments may host older versions of Evilginx or similar phishing frameworks for QA purposes. These environments often have relaxed security controls and may use default Evilginx configurations that match the IOCs, especially if they are not fully isolated from the production network segment.
  • Filter/Exclusion: Exclude hosts tagged with env=staging or env=dev in your CMDB or asset inventory, or