Suspicious Volume Shadow Copy VSS_PS.dll Load (via image_load)

This rule detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is frequently misused by adversaries to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not usually linked with VSS operations can indicate anomalous activity.