Windows suspicious vsstrace.dll image load by uncommon executables

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1490Inhibit System Recovery

What it detects

This rule flags Windows image loads where the loaded module filename ends with '\vsstrace.dll' by executables that are not commonly expected. Attackers can use Volume Shadow Copy–related components to impact recovery, and loading these DLLs outside typical paths or trusted binaries can indicate misuse. The detection relies on image load telemetry (including the loading process image path and the loaded DLL path) and applies multiple exclusions for common system, installer, and recovery locations.

Reporting behind it

Related detections9 linkedT1490 — drag to rearrange

Suspicious Symlink Evaluation Enabled via fsutil

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

Malicious Volume Shadow Copy Deletion via vssadmin

Suspicious Free Space Wipe via cipher.exe

Malicious Shadow Copy Deletion Via WMI

Volume Shadow Copy Deletion via vssadmin or wmic

Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)

Windows suspicious vsstrace.dll image load by uncommon executables

Pivot detection · T1490 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-image-load-of-vsstrace-dll-by-uncommon-executables-48bfd177

title: Windows suspicious vsstrace.dll image load by uncommon executables
id: 2dcb8a62-e78e-4fa2-917a-0c0033435f05
related:
  - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
    type: similar
  - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8
    type: similar
  - id: 48bfd177-7cf2-412b-ad77-baf923489e82
    type: derived
status: test
description: This rule flags Windows image loads where the loaded module filename ends with '\vsstrace.dll' by executables that are not commonly expected. Attackers can use Volume Shadow Copy–related components to impact recovery, and loading these DLLs outside typical paths or trusted binaries can indicate misuse. The detection relies on image load telemetry (including the loading process image path and the loaded DLL path) and applies multiple exclusions for common system, installer, and recovery locations.
references:
  - https://github.com/ORCx41/DeleteShadowCopies
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_vsstrace_susp_load.yml
author: frack113, Huntrule Team
date: 2023-02-17
modified: 2025-12-03
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \vsstrace.dll
  filter_main_windows:
    - Image:
        - C:\Windows\explorer.exe
        - C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    - Image|startswith:
        - C:\Windows\System32\
        - C:\Windows\SysWOW64\
        - C:\Windows\Temp\{
        - C:\Windows\WinSxS\
        - C:\ProgramData\Package Cache\{
  filter_main_program_files:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
  filter_optional_recovery:
    Image|startswith: C:\$WinREAgent\Scratch\
  filter_main_null_image:
    Image: null
  filter_optional_avira:
    Image|contains|all:
      - \temp\is-
      - \avira_system_speedup.tmp
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL