This hunt targets adversary behavior where threat actors leverage Evilginx’s advanced man-in-the-middle phishing infrastructure to bypass multi-factor authentication and exfiltrate credentials. Proactively hunting for these specific IOCs within Azure Sentinel is critical because it enables early detection of sophisticated credential theft campaigns before they escalate into full-scale account compromises.
Malware Family: Evilginx Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 185[.]212[.]131[.]28:9000 | botnet_cc | 2026-07-20 | 75% |
| ip:port | 185[.]212[.]128[.]155:9000 | botnet_cc | 2026-07-20 | 75% |
| ip:port | 169[.]58[.]12[.]228:443 | botnet_cc | 2026-07-20 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Evilginx
let malicious_ips = dynamic(["185.212.131.28", "169.58.12.228", "185.212.128.155"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["185.212.131.28", "169.58.12.228", "185.212.128.155"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios for the ThreatFox: Evilginx IOCs rule in an enterprise environment, along with suggested filters or exclusions:
Endpoint Protection Signature Updates: Security teams often deploy new threat intelligence feeds that include generic Evilginx indicators to test coverage across the fleet. When tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint push these updates via their management consoles, they may generate network traffic or file creation events matching the rule’s IOCs without an actual attack occurring.
10.20.50.0/24) and restrict alerts to non-administrator service accounts, as these updates are typically driven by automated deployment pipelines rather than user interaction.Scheduled Phishing Simulation Campaigns: Enterprise Security Awareness teams frequently run simulated phishing campaigns using platforms like KnowBe4, Proofpoint, or Mimecast. These simulations often utilize Evilginx-style landing pages and IOCs to train users, generating legitimate traffic that mimics the exact behavior of a real Evilginx attack.
*.knowbe4.com, *.proofpoint.com) or implement a time-based filter to suppress alerts during known campaign windows (e.g., “First Tuesday of the month, 09:00–17:00 EST”).IT Administration and Patch Management Jobs: During monthly maintenance windows, IT administrators use tools like Microsoft SCCM, Ivanti, or Ansible to deploy patches that may involve downloading configuration files or scripts from internal repositories hosting Evilginx test artifacts. These scheduled jobs often trigger network connections to the specific IOCs defined in the hunt package as part of a routine