Detects samples of the Mozart POS RAM scraping utility

Hunt Hypothesis

This hunt targets adversaries leveraging the Mozart POS RAM scraping utility to extract sensitive payment card data from memory during transaction processing. Proactively hunting for this behavior in Azure Sentinel is critical because early identification of these specific samples allows SOC teams to validate legitimate merchant deployments against potential unauthorized memory access attempts before they escalate into significant data breaches.

YARA Rule

rule Mozart
{
   meta:
       author = "Nick Hoffman - Morphick Inc"
       description = "Detects samples of the Mozart POS RAM scraping utility"
       reference = "http://securitykitten.github.io/the-mozart-ram-scraper/"
   strings:
       $pdb = "z:\\Slender\\mozart\\mozart\\Release\\mozart.pdb" nocase wide ascii
       $output = {67 61 72 62 61 67 65 2E 74 6D 70 00}
       $service_name = "NCR SelfServ Platform Remote Monitor" nocase wide ascii
       $service_name_short = "NCR_RemoteMonitor"
       $encode_data = {B8 08 10 00 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 8B AC 24 14 10 00 00 89 84 24 0C 10 00 00 56 8B C5 33 F6 33 DB 8D 50 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C2 89 44 24 0C ?? ?? 8B 94 24 1C 10 00 00 57 8B FD 2B FA 89 7C 24 10 ?? ?? 8B 7C 24 10 8A 04 17 02 86 E0 BA 40 00 88 02 B8 ?? ?? ?? ?? 46 8D 78 01 8D A4 24 00 00 00 00 8A 08 40 84 C9 ?? ?? 2B C7 3B F0 ?? ?? 33 F6 8B C5 43 42 8D 78 01 8A 08 40 84 C9 ?? ?? 2B C7 3B D8 ?? ?? 5F 8B B4 24 1C 10 00 00 8B C5 C6 04 33 00 8D 50 01 8A 08 40 84 C9 ?? ?? 8B 8C 24 20 10 00 00 2B C2 51 8D 54 24 14 52 50 56 E8 ?? ?? ?? ?? 83 C4 10 8B D6 5E 8D 44 24 0C 8B C8 5D 2B D1 5B 8A 08 88 0C 02 40 84 C9 ?? ?? 8B 8C 24 04 10 00 00 E8 ?? ?? ?? ?? 81 C4 08 10 00 00}
   condition:
      any of ($pdb, $output, $encode_data) or
      all of ($service*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• http://securitykitten.github.io/the-mozart-ram-scraper/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Mozart POS RAM scraping utility detection rule, tailored for an enterprise environment:

• Scheduled Inventory Reconciliation Jobs

  • Scenario: The nightly inventory synchronization process triggers the Mozart utility to scan active memory on retail terminals. This occurs automatically at 02:00 AM via a scheduled task (e.g., Task Scheduler on Windows or cron on Linux) running under the POS-Service-Account.
  • Filter/Exclusion: Exclude alerts where the process parent is svchost.exe or taskeng.exe and the execution time falls between 01:30 AM and 04:30 AM, specifically targeting hosts within the Retail-Floor-Subnet.

• Remote Desktop Support Sessions

  • Scenario: A Level 2 Help Desk engineer initiates a remote session to troubleshoot a slow checkout terminal. Upon connecting via Microsoft Remote Desktop (RDP) or TeamViewer, they manually launch the Mozart utility to inspect memory leaks in the POS application without triggering an alert.
  • Filter/Exclusion: Suppress alerts originating from known administrative IP ranges (e.g., 10.20.x.x) where the user context matches a member of the IT-Support-Admins group, provided the session duration is less than 45 minutes.

• Post-Patch Configuration Validation

  • Scenario: Following a monthly security patch deployment managed by Microsoft Endpoint Configuration Manager (MECM/SCCM), an automated validation script runs on all POS endpoints. This script invokes the Mozart utility to verify that the RAM scraping service has correctly initialized and is consuming expected resources post-update.
  • Filter/Exclusion: Create a rule exclusion for events where the parent process name contains ccmexec.exe