ThreatFox: Evilginx IOCs

Hunt Hypothesis

This hunt detects adversary behavior consistent with Evilginx, a sophisticated phishing framework that utilizes modern browser APIs to bypass Multi-Factor Authentication (MFA) by cloning legitimate login pages in real-time. The SOC team should proactively hunt for these specific IOCs within Azure Sentinel because Evilginx attacks often evade traditional signature-based defenses, requiring active monitoring of known malicious infrastructure to prevent unauthorized access and credential compromise.

IOC Summary

Malware Family: Evilginx Total IOCs: 5 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`64[.]20[.]61[.]215:5000`	botnet_cc	2026-08-05	75%
ip:port	`185[.]212[.]129[.]70:9000`	botnet_cc	2026-08-05	75%
ip:port	`185[.]212[.]129[.]89:9000`	botnet_cc	2026-08-05	75%
ip:port	`185[.]212[.]131[.]112:9000`	botnet_cc	2026-08-05	75%
ip:port	`185[.]212[.]131[.]113:9000`	botnet_cc	2026-08-05	75%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["185.212.129.70", "185.212.131.112", "185.212.129.89", "64.20.61.215", "185.212.131.113"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.212.129.70", "185.212.131.112", "185.212.129.89", "64.20.61.215", "185.212.131.113"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Evilginx

False Positive Guidance

Here are 3-5 specific false positive scenarios for the ThreatFox: Evilginx IOCs detection rule, along with suggested filters and exclusions tailored for a legitimate enterprise environment:

Scenario: Automated Cloud Backup & Synchronization Jobs
- Context: Enterprise backup solutions like Veeam, Rubrik, or cloud sync tools such as OneDrive for Business often utilize complex redirect chains to verify connectivity before initiating large data transfers. These legitimate services may hit the specific Evilginx IOCs (e.g., evilginx.com or associated subdomains) during their health checks, mimicking the phishing behavior of Evilginx which relies heavily on redirects and iframe injection.
- Suggested Filter/Exclusion: Create a detection exclusion for traffic originating from known backup service account identities (e.g., svc-veeam-backup, svc-onedrive-sync) or specific application execution hashes. Alternatively, filter out alerts where the destination port is 443 and the User-Agent string contains “Veeam” or “Microsoft OneDrive”.
Scenario: Scheduled Security Scanning via EDR Agents
- Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint periodically perform external connectivity tests to validate threat intelligence feeds. These agents may query the Evilginx IOC list directly as part of a scheduled “Threat Intelligence Update” job, triggering the detection logic which interprets this internal polling as an active user interaction with a phishing campaign.
- Suggested Filter/Exclusion: Exclude alerts generated by processes running under the SYSTEM account or specific EDR service paths (e.g., C:\Program Files\CrowdStrike\csagent.exe). Add a filter to suppress alerts where the source process is identified as a known