ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage Evilginx-managed infrastructure to execute sophisticated phishing campaigns that bypass traditional MFA protections through advanced session hijacking. Proactively hunting for these specific IOCs within Azure Sentinel is critical because it enables the SOC team to identify and isolate compromised user sessions before lateral movement occurs, addressing a high-severity threat vector that standard signature-based detections often miss.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["45.59.114.202", "185.212.131.27"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.59.114.202", "185.212.131.27"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Corporate Phishing Simulation Campaigns

  • Scenario: The Security Awareness team utilizes tools like KnowBe4 (GoPhish) or Proofpoint to run internal phishing simulations. These platforms often dynamically generate landing pages that mimic legitimate corporate login portals, using subdomains and IP ranges that may overlap with known Evilginx infrastructure or share similar SSL certificate characteristics.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from the specific IP CIDR blocks assigned to your internal phishing simulation platform (e.g., 10.x.x.x/24 for KnowBe4) and whitelist the specific subdomains used by these tools (e.g., *.phishing-sim.internal.corp).

• Scheduled Endpoint Backup and Sync Jobs

  • Scenario: Enterprise data loss prevention or backup solutions, such as Veeam Backup & Replication or Microsoft OneDrive for Business, perform scheduled synchronization tasks. These jobs frequently connect to external cloud storage gateways that utilize shared CDN networks (like Akamai or Cloudflare) which may host Evilginx IOCs used by other tenants in the same ecosystem.
  • Filter/Exclusion: Exclude alerts where the source process is a known backup agent (e.g., VeeamAgent.exe, OneDrive.exe) and the destination URL matches the organization’s approved cloud storage provider list, specifically filtering out connections to known CDN IP ranges associated with these providers.

• IT Admin Provisioning via Cloud Portals

  • Scenario: System administrators regularly access third-party SaaS management portals (e.g., ServiceNow, Jira Service Management, or Okta) to provision new user accounts