Detection rules › Sigma
Suspicious Volume Shadow Copy VSS_PS.dll Load
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1490 Inhibit System Recovery |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 7 | Image loaded |
Rule body yaml
title: Suspicious Volume Shadow Copy VSS_PS.dll Load
id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
related:
- id: 48bfd177-7cf2-412b-ad77-baf923489e82 # vsstrace.dll
type: similar
- id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 # vssapi.dll
type: similar
status: test
description: |
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
references:
- https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add
- https://twitter.com/am0nsec/status/1412232114980982787
author: Markus Neis, @markus_neis
date: 2021-07-07
modified: 2025-07-11
tags:
- attack.impact
- attack.t1490
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: '\vss_ps.dll'
filter_main_legit:
Image|startswith: 'C:\Windows\'
Image|endswith:
- '\clussvc.exe'
- '\dismhost.exe'
- '\dllhost.exe'
- '\inetsrv\appcmd.exe'
- '\inetsrv\iissetup.exe'
- '\msiexec.exe'
- '\rundll32.exe'
- '\searchindexer.exe'
- '\srtasks.exe'
- '\svchost.exe'
- '\System32\SystemPropertiesAdvanced.exe'
- '\taskhostw.exe'
- '\thor.exe'
- '\thor64.exe'
- '\tiworker.exe'
- '\vssvc.exe'
- '\vssadmin.exe'
- '\WmiPrvSE.exe'
- '\wsmprovhost.exe'
filter_main_update:
CommandLine|startswith: 'C:\$WinREAgent\Scratch\'
CommandLine|contains: '\dismhost.exe {'
filter_main_image_null:
Image: null
filter_optional_programfiles:
# When using this rule in your environment replace the "Program Files" folder by the exact applications you know use this. Examples would be software such as backup solutions
Image|startswith:
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_* and not 1 of filter_optional_*Stage 1: selection
selection:
ImageLoaded|endswith: '\vss_ps.dll'
Stage 2: not filter_main_*
filter_main_legit:
Image|startswith: 'C:\Windows\'
Image|endswith:
- '\clussvc.exe'
- '\dismhost.exe'
- '\dllhost.exe'
- '\inetsrv\appcmd.exe'
- '\inetsrv\iissetup.exe'
- '\msiexec.exe'
- '\rundll32.exe'
- '\searchindexer.exe'
- '\srtasks.exe'
- '\svchost.exe'
- '\System32\SystemPropertiesAdvanced.exe'
- '\taskhostw.exe'
- '\thor.exe'
- '\thor64.exe'
- '\tiworker.exe'
- '\vssvc.exe'
- '\vssadmin.exe'
- '\WmiPrvSE.exe'
- '\wsmprovhost.exe'
filter_main_update:
CommandLine|startswith: 'C:\$WinREAgent\Scratch\'
CommandLine|contains: '\dismhost.exe {'
filter_main_image_null:
Image: null
Stage 3: not filter_optional_programfiles
filter_optional_programfiles:
Image|startswith:
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Image | ends_with | \System32\SystemPropertiesAdvanced.exe |
Image | ends_with | \WmiPrvSE.exe |
Image | ends_with | \clussvc.exe |
Image | ends_with | \dismhost.exe |
Image | ends_with | \dllhost.exe |
Image | ends_with | \inetsrv\appcmd.exe |
Image | ends_with | \inetsrv\iissetup.exe |
Image | ends_with | \msiexec.exe |
Image | ends_with | \rundll32.exe |
Image | ends_with | \searchindexer.exe |
Image | ends_with | \srtasks.exe |
Image | ends_with | \svchost.exe |
Image | ends_with | \taskhostw.exe |
Image | ends_with | \thor.exe |
Image | ends_with | \thor64.exe |
Image | ends_with | \tiworker.exe |
Image | ends_with | \vssadmin.exe |
Image | ends_with | \vssvc.exe |
Image | ends_with | \wsmprovhost.exe |
Image | starts_with | C:\Windows\ |
CommandLine | match | \dismhost.exe { |
CommandLine | starts_with | C:\$WinREAgent\Scratch\ |
Image | is_null | |
Image | starts_with | C:\Program Files (x86)\ |
Image | starts_with | C:\Program Files\ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ImageLoaded | ends_with |
|