This hypothesis targets the presence of known Evilginx indicators of compromise, which signal an adversary is actively deploying a phishing proxy to intercept and capture user credentials in real-time. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised sessions before attackers leverage stolen credentials for lateral movement or privilege escalation within the environment.
Malware Family: Evilginx Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 88[.]119[.]169[.]135:8443 | botnet_cc | 2026-09-21 | 75% |
| ip:port | 194[.]49[.]68[.]166:2030 | botnet_cc | 2026-09-21 | 75% |
| ip:port | 185[.]212[.]128[.]89:9000 | botnet_cc | 2026-09-21 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["194.49.68.166", "88.119.169.135", "185.212.128.89"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["194.49.68.166", "88.119.169.135", "185.212.128.89"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Legitimate SSO/IdP Redirection Chains: Enterprise Single Sign-On (SSO) providers like Okta, Azure AD, or Ping Identity often use intermediate redirect URLs or proxy services (e.g., login.microsoftonline.com or custom sso.company.com paths) that may share similar path structures or query parameters with Evilginx interception endpoints.
/oauth2/authorize, /login) from the IOC match, or whitelist specific User-Agent strings associated with corporate SSO clients.Corporate Web Proxy or WAF Inspection: Security appliances such as F5 BIG-IP, Blue Coat, or Zscaler often insert themselves into the request chain for SSL inspection or content filtering, creating temporary redirect hops or modified Location headers that can mimic phishing redirect patterns.
X-Forwarded-For header contains known corporate proxy IP ranges, or filter out requests where the User-Agent includes proxy identifiers (e.g., Zscaler, BlueCoat, F5-BIG-IP).Internal Staging or QA Environments: Developers frequently spin up staging environments that replicate production SSO flows, sometimes using subdomains like staging-login.company.com or qa-auth.company.com that may inadvertently match generic Evilginx domain patterns or path structures (e.g., /login/, /auth/).
staging-, qa-, dev-, test-) or restrict the rule to production domain zones only (e.g., *.company.com excluding *.staging.company.com).Scheduled Credential Harvesting by Internal Tools: Automated