Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) t. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy VSS_PS.dll Load id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 related: - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 type: similar status: test description: 'Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity. ' references: - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add - https://twitter.com/am0nsec/status/1412232114980982787 author: Markus Neis, @markus_neis date: 2021-07-07 modified: 2025-07-11 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vss_ps.dll filter_main_legit: Image|startswith: C:\Windows\ Image|endswith: - \clussvc.exe - \dismhost.exe - \dllhost.exe - \inetsrv\appcmd.exe - \inetsrv\iissetup.exe - \msiexec.exe - \rundll32.exe - \searchindexer.exe - \srtasks.exe - \svchost.exe - \System32\SystemPropertiesAdvanced.exe - \taskhostw.exe - \thor.exe - \thor64.exe - \tiworker.exe - \vssvc.exe - \vssadmin.exe - \WmiPrvSE.exe - \wsmprovhost.exe filter_main_update: CommandLine|startswith: C:\$WinREAgent\Scratch\ CommandLine|contains: \dismhost.exe { filter_main_image_null: Image: null filter_optional_programfiles: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uninstallation or termination of security products using the WMIC utility. Logsource: windows / process_creation. Rule: title: Potential Tampering With Security Products Via WMIC id: 847d5ff3-8a31-4737-a970-aeae8fe21765 related: - id: b53317a0-8acf-4fd1-8de8-a5401e776b96 type: derived status: test description: Detects uninstallation or termination of security products using the WMIC utility references: - https://twitter.com/cglyer/status/1355171195654709249 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-01-30 modified: 2025-12-15 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_cli_1: CommandLine|contains|all: - wmic - 'product ' - uninstall CommandLine|contains|windash: /nointeractive selection_cli_2: CommandLine|contains|all: - wmic - 'caption like ' CommandLine|contains: - call delete - call terminate selection_cli_3: CommandLine|contains|all: - 'process ' - 'where ' - delete selection_product: CommandLine|contains: - '%carbon%' - '%cylance%' - '%endpoint%' - '%eset%' - '%malware%' - '%Sophos%' - '%symantec%' - Antivirus - 'AVG ' - Carbon Black - CarbonBlack - Cb Defense Sensor 64-bit - Crowdstrike Sensor - 'Cylance ' - Dell Threat Defense - DLP Endpoint - Endpoint Detection - Endpoint Protection - Endpoint Security - Endpoint Sensor - ESET File Security - LogRhythm System Monitor Service - Malwarebytes - McAfee Agent - Microsoft Security Client - Sophos Anti-Virus - Sophos AutoUpdate - Sophos Credential Store - Sophos Management Console - Sophos Management Database - Sophos Management Server - Sophos Remote Management System - Sophos Update Manager - Threat Protection - VirusScan - Webroot SecureAnywhere - Windows Defender condition: 1 of selection_cli_* and selection_product falsepositives: - Legitimate administration level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products/info.yml