name: Common Phishing Frameworks
id: 9a64ab44-9214-4639-8163-7eaa2621bd61
version: 1
date: '2019-04-29'
description: 'Detect DNS and web requests to fake websites generated by the EvilGinx2
  toolkit. These websites are designed to fool unwitting users who have clicked on
  a malicious link in a phishing email. '
narrative: 'As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/),
  familiar contact names inserted as senders, and other tactics to lure targets into
  clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/),
  or entering sensitive personal information that perpetrators may intercept. This
  attack technique requires a relatively low level of skill and allows adversaries
  to easily cast a wide net. Because phishing is a technique that relies on human
  psychology, you will never be able to eliminate this vulnerability 100%. But you
  can use automated detection to significantly reduce the risks.\

  This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2),
  a toolkit that sets up a transparent proxy between the targeted site and the user.
  In this way, the attacker is able to intercept credentials and two-factor identification
  tokens. It employs a proxy template to allow a registered domain to impersonate
  targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit,
  Office 365, and others. It can even register SSL certificates and camouflage them
  via a URL shortener, making them difficult to detect. Searches in this story look
  for signs of MiTM attacks enabled by EvilGinx2.'
author: Splunk Research Team, Splunk
type: ESCU
references:
- https://github.com/kgretzky/evilginx2
- https://attack.mitre.org/techniques/T1192/
- https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/
tags:
  analytics_story: Common Phishing Frameworks
  usecase: Advanced Threat Detection
  category:
  - Adversary Tactics