Pony Malware Local Account Brute-Force via LogonUserA (T1110)

Ethan Andrews@eandrews

•updated Jun 22, 2026•2•0•6

Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine. The rule identifies a high volume of type-2 interactive logon failures against multiple local accounts in a short time window, indicative of brute-force activity using LogonUserA.