Ponmocup plugin detection (memory)

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging the Ponmocup plugin to establish persistent memory-based footholds within the environment, potentially evading traditional file-system monitoring. The SOC team should proactively hunt for this behavior in Azure Sentinel to validate legitimate usage patterns and identify anomalous memory injections before they escalate into larger compromise incidents.

YARA Rule

rule Ponmocup : plugins memory
{
 			meta: 
 					description = "Ponmocup plugin detection (memory)"
 					author = "Danny Heppener, Fox-IT"
 					reference = "https://foxitsecurity.files.wordpress.com/2015/12/foxit-whitepaper_ponmocup_1_1.pdf"
 			strings:
					 $1100 = {4D 5A 90 [29] 4C 04}
					 $1201 = {4D 5A 90 [29] B1 04}
					 $1300 = {4D 5A 90 [29] 14 05}
					 $1350 = {4D 5A 90 [29] 46 05}
					 $1400 = {4D 5A 90 [29] 78 05}
					 $1402 = {4D 5A 90 [29] 7A 05}
					 $1403 = {4D 5A 90 [29] 7B 05}
					 $1404 = {4D 5A 90 [29] 7C 05}
					 $1405 = {4D 5A 90 [29] 7D 05}
					 $1406 = {4D 5A 90 [29] 7E 05}
					 $1500 = {4D 5A 90 [29] DC 05}
					 $1501 = {4D 5A 90 [29] DD 05}
					 $1502 = {4D 5A 90 [29] DE 05}
					 $1505 = {4D 5A 90 [29] E1 05}
					 $1506 = {4D 5A 90 [29] E2 05}
					 $1507 = {4D 5A 90 [29] E3 05}
					 $1508 = {4D 5A 90 [29] E4 05}
					 $1509 = {4D 5A 90 [29] E5 05}
					 $1510 = {4D 5A 90 [29] E6 05}
					 $1511 = {4D 5A 90 [29] E7 05}
					 $1512 = {4D 5A 90 [29] E8 05}
					 $1600 = {4D 5A 90 [29] 40 06}
					 $1601 = {4D 5A 90 [29] 41 06}
					 $1700 = {4D 5A 90 [29] A4 06}
					 $1800 = {4D 5A 90 [29] 08 07}
					 $1801 = {4D 5A 90 [29] 09 07}
					 $1802 = {4D 5A 90 [29] 0A 07}
					 $1803 = {4D 5A 90 [29] 0B 07}
					 $2001 = {4D 5A 90 [29] D1 07}
					 $2002 = {4D 5A 90 [29] D2 07}
					 $2003 = {4D 5A 90 [29] D3 07}
					 $2004 = {4D 5A 90 [29] D4 07}
					 $2500 = {4D 5A 90 [29] C4 09}
					 $2501 = {4D 5A 90 [29] C5 09}
					 $2550 = {4D 5A 90 [29] F6 09}
					 $2600 = {4D 5A 90 [29] 28 0A}
					 $2610 = {4D 5A 90 [29] 32 0A}
					 $2700 = {4D 5A 90 [29] 8C 0A}
					 $2701 = {4D 5A 90 [29] 8D 0A}
					 $2750 = {4D 5A 90 [29] BE 0A}
					 $2760 = {4D 5A 90 [29] C8 0A}
					 $2810 = {4D 5A 90 [29] FA 0A}
 			condition:
 					 any of ($1100,$1201,$1300,$1350,$1400,$1402,$1403,$1404,$1405,$1406,
$1500,$1501,$1502,$1505,$1506,$1507,$1508,$1509,$1510,$1511,$1512,$1600,$1601,$1700,$1800,$1801,
$1802,$1803,$2001,$2002,$2003,$2004,$2500,$2501,$2550,$2600,$2610,$2700,$2701,$2750,$2760,$2810)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 42 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Ponmocup plugin detection (memory) rule in an enterprise environment, along with suggested filters or exclusions:

Scheduled Antivirus Memory Scans
- Scenario: Enterprise endpoint protection suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently load specific memory modules to scan running processes. During these scans, the antivirus engine may inject a temporary plugin into the Ponmocup service’s address space to verify integrity, triggering the detection logic without any malicious intent.
- Suggested Filter: Exclude events where the parent process is the known AV scanner (e.g., CrowdStrike.exe, SentinelOneAgent.exe) or filter by the specific User Account used for scheduled scans (e.g., NT AUTHORITY\SYSTEM or a dedicated svc-antivirus-scan account).
Automated Patch Management and Software Updates
- Scenario: Tools such as Ivanti, SCCM (Microsoft Endpoint Configuration Manager), or Jamf Pro execute scheduled tasks to update the Ponmocup plugin. During the installation phase, these tools load configuration scripts into memory that mimic the behavior of a new plugin deployment, causing the detection rule to fire during routine maintenance windows.
- Suggested Filter: Create an exclusion for events occurring within defined maintenance windows (e.g., 02:00–04:00 UTC) where the initiating process is ccmexec.exe (SCCM), IvantiAgent.exe, or JamfProAgent.
Database Backup and Archiving Jobs
- Scenario: In environments where Ponmocup integrates with SQL databases, backup utilities like Veeam Backup & Replication, Commvault, or native SQL Server Maintenance Plans often attach memory hooks