Pony Credential Harvesting via Multi-App Credential Store Enumeration
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for non-browser/non-client processes accessing multiple credential-related files in common application data directories.
Microsoft Sentinel (KQL)
