Suspicious Volume Shadow Copy VSS_PS.dll Load

Title: Suspicious Volume Shadow Copy VSS_PS.dll Load
Status: test
Description:Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
References:
  -https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add
  -https://twitter.com/am0nsec/status/1412232114980982787
Author: Markus Neis, @markus_neis
Date: 2021-07-07
modified:2025-07-11
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|endswith: '\vss_ps.dll'
  filter_main_legit:
    Image|startswith: 'C:\Windows\'
    Image|endswith:
      -'\clussvc.exe'
      -'\dismhost.exe'
      -'\dllhost.exe'
      -'\inetsrv\appcmd.exe'
      -'\inetsrv\iissetup.exe'
      -'\msiexec.exe'
      -'\rundll32.exe'
      -'\searchindexer.exe'
      -'\srtasks.exe'
      -'\svchost.exe'
      -'\System32\SystemPropertiesAdvanced.exe'
      -'\taskhostw.exe'
      -'\thor.exe'
      -'\thor64.exe'
      -'\tiworker.exe'
      -'\vssvc.exe'
      -'\vssadmin.exe'
      -'\WmiPrvSE.exe'
      -'\wsmprovhost.exe'

  filter_main_update:
    CommandLine|startswith: 'C:\$WinREAgent\Scratch\'
    CommandLine|contains: '\dismhost.exe {'
  filter_main_image_null:
    Image: 'None'
  filter_optional_programfiles:
    Image|startswith:
      -'C:\Program Files\'
      -'C:\Program Files (x86)\'

  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high