Suspicious Volume Shadow Copy VSS_PS.dll Load

 1title: Suspicious Volume Shadow Copy VSS_PS.dll Load
 2id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
 3related:
 4    - id: 48bfd177-7cf2-412b-ad77-baf923489e82 # vsstrace.dll
 5      type: similar
 6    - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 # vssapi.dll
 7      type: similar
 8status: test
 9description: |
10    Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
11    It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
12    The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.    
13references:
14    - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add
15    - https://twitter.com/am0nsec/status/1412232114980982787
16author: Markus Neis, @markus_neis
17date: 2021-07-07
18modified: 2025-07-11
19tags:
20    - attack.impact
21    - attack.t1490
22logsource:
23    category: image_load
24    product: windows
25detection:
26    selection:
27        ImageLoaded|endswith: '\vss_ps.dll'
28    filter_main_legit:
29        Image|startswith: 'C:\Windows\'
30        Image|endswith:
31            - '\clussvc.exe'
32            - '\dismhost.exe'
33            - '\dllhost.exe'
34            - '\inetsrv\appcmd.exe'
35            - '\inetsrv\iissetup.exe'
36            - '\msiexec.exe'
37            - '\rundll32.exe'
38            - '\searchindexer.exe'
39            - '\srtasks.exe'
40            - '\svchost.exe'
41            - '\System32\SystemPropertiesAdvanced.exe'
42            - '\taskhostw.exe'
43            - '\thor.exe'
44            - '\thor64.exe'
45            - '\tiworker.exe'
46            - '\vssvc.exe'
47            - '\vssadmin.exe'
48            - '\WmiPrvSE.exe'
49            - '\wsmprovhost.exe'
50    filter_main_update:
51        CommandLine|startswith: 'C:\$WinREAgent\Scratch\'
52        CommandLine|contains: '\dismhost.exe {'
53    filter_main_image_null:
54        Image: null
55    filter_optional_programfiles:
56        # When using this rule in your environment replace the "Program Files" folder by the exact applications you know use this. Examples would be software such as backup solutions
57        Image|startswith:
58            - 'C:\Program Files\'
59            - 'C:\Program Files (x86)\'
60    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
61falsepositives:
62    - Unknown
63level: high