Windows Image Load of vsstrace.dll by Uncommon Executables

title: Windows Image Load of vsstrace.dll by Uncommon Executables
id: 2dcb8a62-e78e-4fa2-917a-0c0033435f05
related:
  - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
    type: similar
  - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8
    type: similar
  - id: 48bfd177-7cf2-412b-ad77-baf923489e82
    type: derived
status: test
description: This rule flags when an executable loads vsstrace.dll, specifically when the loading image does not match several common Windows and known system-location patterns. Loading Volume Shadow Copy-related tracing DLLs from an unusual process can be an indicator of shadow copy discovery or related impact activity. It relies on Windows image load telemetry that records the loaded module path (ending with \vsstrace.dll) and the loading process image path.
references:
  - https://github.com/ORCx41/DeleteShadowCopies
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_vsstrace_susp_load.yml
author: frack113, Huntrule Team
date: 2023-02-17
modified: 2025-12-03
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \vsstrace.dll
  filter_main_windows:
    - Image:
        - C:\Windows\explorer.exe
        - C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    - Image|startswith:
        - C:\Windows\System32\
        - C:\Windows\SysWOW64\
        - C:\Windows\Temp\{
        - C:\Windows\WinSxS\
        - C:\ProgramData\Package Cache\{
  filter_main_program_files:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
  filter_optional_recovery:
    Image|startswith: C:\$WinREAgent\Scratch\
  filter_main_null_image:
    Image: null
  filter_optional_avira:
    Image|contains|all:
      - \temp\is-
      - \avira_system_speedup.tmp
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1