Windows Image Load of vssapi.dll by Uncommon Executables

title: Windows Image Load of vssapi.dll by Uncommon Executables
id: 3e2d3365-3b2a-4fa6-a9fa-24d9e97ff0bc
related:
  - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
    type: similar
  - id: 48bfd177-7cf2-412b-ad77-baf923489e82
    type: similar
  - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8
    type: derived
status: test
description: This rule flags Windows process image loads where ImageLoaded ends with \vssapi.dll, but only when the loading Image is not one of several common system or installer locations. Attackers may load Shadow Copy–related DLLs to interact with volume snapshots as part of impact or evasion, making uncommon loaders a useful anomaly signal. It relies on image load telemetry (process image load events) with the loaded DLL path and the loading process image path, plus exclusion filters to reduce known benign cases.
references:
  - https://github.com/ORCx41/DeleteShadowCopies
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_vssapi_susp_load.yml
author: frack113, Huntrule Team
date: 2022-10-31
modified: 2026-05-18
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \vssapi.dll
  filter_main_windows:
    - Image:
        - C:\Windows\explorer.exe
        - C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    - Image|startswith:
        - C:\Windows\System32\
        - C:\Windows\SysWOW64\
        - C:\Windows\Temp\{
        - C:\Windows\WinSxS\
        - C:\$WinREAgent\Scratch\
  filter_main_program_files:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
  filter_main_null_image:
    Image: null
  filter_optional_programdata_packagecache:
    Image|startswith: C:\ProgramData\Package Cache\
  filter_optional_avira:
    Image|contains|all:
      - \temp\is-
      - \avira_system_speedup.tmp
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1