Windows Image Load: Uncommon VSSAPI DLL (vssapi.dll) by Suspicious Executables
Alerts when uncommon processes load vssapi.dll, a Shadow Copy–related DLL, using image load telemetry with path-based exclusions.
- Product
- windows
- Category
- image_load
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-10-31
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags image load events where vssapi.dll is loaded via processes other than a small set of common Windows binaries. Loading VSS-related components can be abused to impact data by interacting with Volume Shadow Copy functionality, so unusual loaders are a strong signal. It relies on Windows image load telemetry for vssapi.dll and filters out expected system and trusted installer locations to reduce false positives.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Image Load: Uncommon VSSAPI DLL (vssapi.dll) by Suspicious Executables"
id: 3e2d3365-3b2a-4fa6-a9fa-24d9e97ff0bc
related:
- id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
type: similar
- id: 48bfd177-7cf2-412b-ad77-baf923489e82
type: similar
- id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8
type: derived
status: test
description: This rule flags image load events where vssapi.dll is loaded via processes other than a small set of common Windows binaries. Loading VSS-related components can be abused to impact data by interacting with Volume Shadow Copy functionality, so unusual loaders are a strong signal. It relies on Windows image load telemetry for vssapi.dll and filters out expected system and trusted installer locations to reduce false positives.
references:
- https://github.com/ORCx41/DeleteShadowCopies
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_vssapi_susp_load.yml
author: frack113, Huntrule Team
date: 2022-10-31
modified: 2026-05-18
tags:
- attack.impact
- attack.t1490
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \vssapi.dll
filter_main_windows:
- Image:
- C:\Windows\explorer.exe
- C:\Windows\ImmersiveControlPanel\SystemSettings.exe
- Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Windows\Temp\{
- C:\Windows\WinSxS\
- C:\$WinREAgent\Scratch\
filter_main_program_files:
Image|startswith:
- C:\Program Files\
- C:\Program Files (x86)\
filter_main_null_image:
Image: null
filter_optional_programdata_packagecache:
Image|startswith: C:\ProgramData\Package Cache\
filter_optional_avira:
Image|contains|all:
- \temp\is-
- \avira_system_speedup.tmp
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: high
license: DRL-1.1