---
title: "Common Phishing Frameworks"
last_modified_at: 2019-04-29
toc: true
toc_label: ""
tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  - Network_Resolution
  - Command & Control
  - Delivery
---

[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

#### Description

Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. 

- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
- **Last Updated**: 2019-04-29
- **Author**: Splunk Research Team, Splunk
- **ID**: 9a64ab44-9214-4639-8163-7eaa2621bd61

#### Narrative

As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\
This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.

#### Detections

| Name        | Technique   | Type         |
| ----------- | ----------- |--------------|
| [Detect DNS requests to Phishing Sites leveraging EvilGinx2](/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2/) | [Spearphishing via Service](/tags/#spearphishing-via-service)| TTP |

#### Reference

* [https://github.com/kgretzky/evilginx2](https://github.com/kgretzky/evilginx2)
* [https://attack.mitre.org/techniques/T1192/](https://attack.mitre.org/techniques/T1192/)
* [https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/](https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/)



[*source*](https://github.com/splunk/security_content/tree/develop/stories/common_phishing_frameworks.yml) \| *version*: **1**