Windows suspicious vsstrace.dll image load by uncommon executables
Alert on vsstrace.dll module loads from processes outside common Windows/system paths.
- Product
- windows
- Category
- image_load
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-02-17
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows image loads where the loaded module filename ends with '\vsstrace.dll' by executables that are not commonly expected. Attackers can use Volume Shadow Copy–related components to impact recovery, and loading these DLLs outside typical paths or trusted binaries can indicate misuse. The detection relies on image load telemetry (including the loading process image path and the loaded DLL path) and applies multiple exclusions for common system, installer, and recovery locations.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows suspicious vsstrace.dll image load by uncommon executables
id: 2dcb8a62-e78e-4fa2-917a-0c0033435f05
related:
- id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
type: similar
- id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8
type: similar
- id: 48bfd177-7cf2-412b-ad77-baf923489e82
type: derived
status: test
description: This rule flags Windows image loads where the loaded module filename ends with '\vsstrace.dll' by executables that are not commonly expected. Attackers can use Volume Shadow Copy–related components to impact recovery, and loading these DLLs outside typical paths or trusted binaries can indicate misuse. The detection relies on image load telemetry (including the loading process image path and the loaded DLL path) and applies multiple exclusions for common system, installer, and recovery locations.
references:
- https://github.com/ORCx41/DeleteShadowCopies
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_vsstrace_susp_load.yml
author: frack113, Huntrule Team
date: 2023-02-17
modified: 2025-12-03
tags:
- attack.impact
- attack.t1490
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \vsstrace.dll
filter_main_windows:
- Image:
- C:\Windows\explorer.exe
- C:\Windows\ImmersiveControlPanel\SystemSettings.exe
- Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Windows\Temp\{
- C:\Windows\WinSxS\
- C:\ProgramData\Package Cache\{
filter_main_program_files:
Image|startswith:
- C:\Program Files\
- C:\Program Files (x86)\
filter_optional_recovery:
Image|startswith: C:\$WinREAgent\Scratch\
filter_main_null_image:
Image: null
filter_optional_avira:
Image|contains|all:
- \temp\is-
- \avira_system_speedup.tmp
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1