Suspicious Volume Shadow Copy VSS_PS.dll Load

Hunt Hypothesis

The hypothesis is that an adversary is leveraging the VSS_PS.dll DLL to execute persistence or exfiltration through shadow copy mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential advanced persistent threats that use VSS for covert operations.

Detection Rule

Sigma (Original)

title: Suspicious Volume Shadow Copy VSS_PS.dll Load
id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70
related:
    - id: 48bfd177-7cf2-412b-ad77-baf923489e82 # vsstrace.dll
      type: similar
    - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 # vssapi.dll
      type: similar
status: test
description: |
    Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
    It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
    The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
references:
    - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add
    - https://twitter.com/am0nsec/status/1412232114980982787
author: Markus Neis, @markus_neis
date: 2021-07-07
modified: 2025-07-11
tags:
    - attack.defense-evasion
    - attack.impact
    - attack.t1490
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\vss_ps.dll'
    filter_main_legit:
        Image|startswith: 'C:\Windows\'
        Image|endswith:
            - '\clussvc.exe'
            - '\dismhost.exe'
            - '\dllhost.exe'
            - '\inetsrv\appcmd.exe'
            - '\inetsrv\iissetup.exe'
            - '\msiexec.exe'
            - '\rundll32.exe'
            - '\searchindexer.exe'
            - '\srtasks.exe'
            - '\svchost.exe'
            - '\System32\SystemPropertiesAdvanced.exe'
            - '\taskhostw.exe'
            - '\thor.exe'
            - '\thor64.exe'
            - '\tiworker.exe'
            - '\vssvc.exe'
            - '\vssadmin.exe'
            - '\WmiPrvSE.exe'
            - '\wsmprovhost.exe'
    filter_main_update:
        CommandLine|startswith: 'C:\$WinREAgent\Scratch\'
        CommandLine|contains: '\dismhost.exe {'
    filter_main_image_null:
        Image: null
    filter_optional_programfiles:
        # When using this rule in your environment replace the "Program Files" folder by the exact applications you know use this. Examples would be software such as backup solutions
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high

KQL (Microsoft 365 Defender)

DeviceImageLoadEvents
| where FolderPath endswith "\\vss_ps.dll" and (not(((InitiatingProcessFolderPath startswith "C:\\Windows\\" and (InitiatingProcessFolderPath endswith "\\clussvc.exe" or InitiatingProcessFolderPath endswith "\\dismhost.exe" or InitiatingProcessFolderPath endswith "\\dllhost.exe" or InitiatingProcessFolderPath endswith "\\inetsrv\\appcmd.exe" or InitiatingProcessFolderPath endswith "\\inetsrv\\iissetup.exe" or InitiatingProcessFolderPath endswith "\\msiexec.exe" or InitiatingProcessFolderPath endswith "\\rundll32.exe" or InitiatingProcessFolderPath endswith "\\searchindexer.exe" or InitiatingProcessFolderPath endswith "\\srtasks.exe" or InitiatingProcessFolderPath endswith "\\svchost.exe" or InitiatingProcessFolderPath endswith "\\System32\\SystemPropertiesAdvanced.exe" or InitiatingProcessFolderPath endswith "\\taskhostw.exe" or InitiatingProcessFolderPath endswith "\\thor.exe" or InitiatingProcessFolderPath endswith "\\thor64.exe" or InitiatingProcessFolderPath endswith "\\tiworker.exe" or InitiatingProcessFolderPath endswith "\\vssvc.exe" or InitiatingProcessFolderPath endswith "\\vssadmin.exe" or InitiatingProcessFolderPath endswith "\\WmiPrvSE.exe" or InitiatingProcessFolderPath endswith "\\wsmprovhost.exe")) or (InitiatingProcessCommandLine startswith "C:\\$WinREAgent\\Scratch\\" and InitiatingProcessCommandLine contains "\\dismhost.exe {") or isnull(InitiatingProcessFolderPath)))) and (not((InitiatingProcessFolderPath startswith "C:\\Program Files\\" or InitiatingProcessFolderPath startswith "C:\\Program Files (x86)\\")))

False Positive Guidance

Scenario: Scheduled System Maintenance Task
Description: A legitimate scheduled task runs a script that loads vss_ps.dll as part of a system maintenance or backup process.
Filter/Exclusion: Check the command line or task description for keywords like “backup”, “maintenance”, or “system scan”. Exclude processes associated with known backup tools (e.g., wbadmin, vssadmin).
Scenario: Windows Update or Patching Process
Description: During a Windows update or patching operation, vss_ps.dll may be loaded by system services or update-related executables.
Filter/Exclusion: Filter by process name such as svchost.exe or wuauclt.exe. Exclude events occurring during known update windows or with msiexec/setup.exe.
Scenario: Volume Shadow Copy Service (VSS) Management Tool
Description: A system administrator uses a tool like vssadmin or wbadmin to manage shadow copies, which may result in vss_ps.dll being loaded.
Filter/Exclusion: Check for command-line arguments related to VSS management. Exclude processes with vssadmin or wbadmin in the command line.
Scenario: Antivirus or Endpoint Protection Scan
Description: Some endpoint protection tools use VSS to create snapshots during scans, which may trigger the load of vss_ps.dll.
Filter/Exclusion: Filter by process name such as mpsvc.exe, mfev.exe, or avp.exe. Exclude events during scheduled scans or with known AV tool signatures.
Scenario: Windows Server Backup Service
Description: The Windows Server Backup service may load vss_ps.dll when creating or

MITRE ATT&CK Context

Tactic: Defense Evasion
Tactic: Impact
Technique: T1490