Pony-Style Multi-Application Credential Sweep Within 60 Seconds

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

This rule detects a single process attempting to access credential-related files (e.g., browser login data, FTP client configurations) and/or registry keys (e.g., PuTTY, WinSCP sessions) from at least two different application types within a 60-second window. This behavior is indicative of an attacker attempting to rapidly harvest credentials from various sources on a compromised endpoint.