ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage Evilginx’s advanced phishing infrastructure to deploy sophisticated man-in-the-middle attacks that bypass traditional MFA defenses by mimicking legitimate login portals. The SOC team should proactively hunt for these specific IOCs within Azure Sentinel to identify early-stage credential compromise attempts before they escalate into full-scale account takeovers or lateral movement.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["147.182.176.38", "185.117.90.47"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["147.182.176.38", "185.117.90.47"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule within an enterprise environment, along with suggested filters or exclusions:

• Legitimate Cloud Service Provider Connectivity

  • Scenario: Enterprise endpoints (e.g., laptops running Microsoft 365 or Salesforce) initiate connections to known Evilginx-related IP addresses that are actually part of a shared cloud infrastructure provider (such as AWS, Azure, or Google Cloud) used by the organization’s SaaS vendors. The detection logic flags these IPs because they appear in the ThreatFox IOC feed for Evilginx, but the traffic is benign business communication rather than phishing activity.
  • Suggested Filter: Exclude network flows where the destination IP belongs to a whitelisted Cloud Provider ASN (e.g., AS16509 for AWS) AND the user agent string contains known enterprise application identifiers (e.g., Mozilla/5.0 ... Office/365 or specific Salesforce API tokens).

• Security Operations Center (SOC) Threat Intelligence Updates

  • Scenario: The organization’s internal threat intelligence platform (such as Tenable.io, CrowdStrike Falcon, or Splunk Enterprise Security) automatically pulls and validates the latest IOC feeds from ThreatFox. During this scheduled ingestion process, the security appliances themselves generate network traffic to the Evilginx IOCs to verify their status or download updated signatures, triggering the rule on the management plane rather than user endpoints.
  • Suggested Filter: Create an exclusion for source IPs belonging to the internal Security Operations subnet (e.g., 10.20.50.0/24) and restrict the alert scope to exclude traffic originating from specific service accounts used by threat intelligence tools (e.g., svc-threat-intel or admin-splunk).

• **Scheduled Vulnerability Scanning and Patch