ThreatFox: Evilginx IOCs

Hunt Hypothesis

This detection rule identifies adversary activity involving Evilginx phishing campaigns by monitoring for specific Indicators of Compromise (IOCs) known to facilitate advanced credential harvesting and session hijacking. A SOC team should proactively hunt for these signals within Azure Sentinel to rapidly detect and mitigate sophisticated attacks that bypass traditional multi-factor authentication defenses through man-in-the-middle techniques.

IOC Summary

Malware Family: Evilginx Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["104.207.90.3", "104.207.90.93"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.207.90.3", "104.207.90.93"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Evilginx

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: Evilginx IOCs detection rule:

• Scenario: Scheduled Backup Jobs Accessing Cloud Storage Gateways

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik often utilize cloud gateways (e.g., AWS S3, Azure Blob) that share IP ranges or domain suffixes with Evilginx infrastructure. When these scheduled jobs run nightly to sync data, they may trigger the rule if their egress IPs overlap with known Evilginx IOCs.
  • Filter/Exclusion: Create a whitelist exclusion for specific backup service accounts (e.g., svc-veeam-backup) and restrict the rule to exclude traffic originating from the dedicated backup subnet (e.g., 10.50.40.0/24). Additionally, filter out connections where the destination port is strictly 80 or 443 and the User-Agent string contains “Veeam” or “Rubrik”.

• Scenario: Managed Security Service Provider (MSSP) Telemetry

  • Context: Many organizations subscribe to third-party threat intelligence feeds or managed detection services (e.g., CrowdStrike Falcon, Tenable.io) that utilize shared infrastructure IPs. If the MSSP’s telemetry collectors or update servers reside on an IP range flagged by ThreatFox as Evilginx, routine heartbeat checks and log uploads will generate alerts.
  • Filter/Exclusion: Implement a rule exclusion based on the source hostname pattern (e.g., *.crowdstrike.com or *.tenable.com). Configure the detection logic to ignore events where the process name is falcon-sensor.exe or tnagent.exe, as these represent legitimate management traffic rather than user-facing phishing activity.

• **Scenario: