Pony Credential Harvesting via Multi-App Credential Store Enumeration
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for file read or access actions on common credential files within typical application data directories, while excluding legitimate processes that would normally access these files.
Microsoft Sentinel (KQL)
