Identify Pony

Hunt Hypothesis

This detection rule identifies the presence of the Pony banking Trojan, which typically establishes persistence on endpoints to harvest credentials and monitor user activity for financial data exfiltration. Proactively hunting for this behavior in Azure Sentinel is critical because early identification allows the SOC team to isolate affected assets before the malware can compromise sensitive banking information or pivot laterally across the network.

YARA Rule

rule pony {
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2014-08-16"
        description = "Identify Pony"
	strings:
    	$s1 = "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"
    	$s2 = "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0"
    	$s3 = "POST %s HTTP/1.0"
    	$s4 = "Accept-Encoding: identity, *;q=0"

    	//$useragent1 = "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
    	//$useragent2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)"
    condition:
        $s1 and $s2 and $s3 and $s4
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Identify Pony detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Antivirus Definitions Update via WSUS/SCCM

  • Scenario: The “Pony” logic likely flags the rapid download and execution of security definition updates. In a standard enterprise setup, Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager (MECM/SCCM) pushes these updates to thousands of endpoints simultaneously during maintenance windows, triggering high-volume network traffic and file system changes that mimic the rule’s trigger conditions.
  • Filter/Exclusion: Create an exclusion for processes originating from ccmexec.exe (Configuration Manager) or wuauclt.exe (Windows Update) running under the SYSTEM account during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Automated Patch Deployment by Admin Tools

  • Scenario: System administrators frequently use tools like Ansible, Chef, or SaltStack to deploy configuration changes and patches across the fleet. These orchestration agents execute scripts that modify registry keys, install binaries, and restart services in a sequence that can be indistinguishable from the “Pony” detection logic, especially when running as part of a nightly compliance check.
  • Filter/Exclusion: Exclude events where the parent process is ansible-runner, chef-client, or salt-minion and the user context matches known service accounts (e.g., svc_ansible_deploy) rather than interactive user sessions.

• Backup Software Snapshot Operations

  • Scenario: Enterprise backup solutions such as Veeam Backup & Replication, Commvault, or Rubrik perform frequent snapshot operations. These jobs involve heavy I/O, temporary file creation, and network transfers