Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
10
Contributors
4
3
3
Categories
6
5
3
3
2
Platforms
10
1
Products / Services
5
4
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects suspicious execution of .scr (screensaver) files, execution of 'SecureMessage' named executables (potentially Pony malware), and email attachments containing .scr or .zip files, which are common vectors for malware delivery.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for non-browser/non-client processes accessing multiple credential-related files in common application data directories.
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine, which enumerates local accounts via NetUserEnum and cycles passwords via LogonUserA (advapi32). A high volume of type-2 interactive logon failures against multiple local accounts in a short window is the key behavioral signal.
Detects common self-deletion patterns used by Pony malware, including the use of 'cmd.exe' with 'del /f' targeting executables in temporary or application data directories, batch file self-deletion loops, and PowerShell 'Remove-Item' or '[System.IO.File]::Delete()' targeting its own image path.
This rule detects potential Pony malware anti-sandbox evasion techniques by correlating WMI queries for virtual machine artifacts and registry reads for BIOS/VM strings with the termination of short-lived processes (less than 30 seconds). This behavior is indicative of malware attempting to determine if it's running in a sandbox environment and exiting if it detects one.
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine. The rule identifies a high volume of type-2 interactive logon failures against multiple local accounts in a short time window, indicative of brute-force activity using LogonUserA.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for file read or access actions on common credential files within typical application data directories, while excluding legitimate processes that would normally access these files.
Detects Pony malware dropping a self-deletion batch script into %TEMP% via ShellExecuteA, then executing it with cmd.exe. The batch loops using 'if exist %1 goto' until the loader file lock is released, deletes the loader, then deletes itself with 'del %0'. Correlates .bat file creation in TEMP with subsequent cmd.exe execution of that same file on the same device.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for file read or access events on common credential files within typical application data directories, while excluding legitimate browser and application processes.
Detects the Pony malware credential harvesting sequence where a non-system process performs repeated interactive logon attempts (LogonUserA dictionary brute force via NetUserEnum) against local accounts and achieves at least one successful logon, after which LoadUserProfileA is used to impersonate the compromised account and harvest profile-scoped credentials.