Query: rule covering Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) t
Matching passage: Sigma rule: Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) t. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy VSS_PS.dll Load id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 related: - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 type: similar status: test description: 'Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity. ' references: - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add - https://twitter.com/am0nsec/status/1412232114980982787 author: Markus Neis, @markus_neis date: 2021-07-07 modified: 2025-07-11 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vss_ps.dll filter_main_legit: Image|startswith: C:\Windows\ Image|endswith: - \clussvc.exe - \dismhost.exe - \dllhost.exe - \inetsrv\appcmd.exe - \inetsrv\iissetup.exe - \msiexec.exe - \rundll32.exe - \searchindexer.exe - \srtasks.exe - \svchost.exe - \System32\SystemPropertiesAdvanced.exe - \taskhostw.exe - \thor.exe - \thor64.exe - \tiworker.exe - \vssvc.exe - \vssadmin.exe - \WmiPrvSE.exe - \wsmprovhost.exe filter_main_update: CommandLine|startswith: C:\$WinREAgent\Scratch\ CommandLine|contains: \dismhost.exe { filter_main_image_null: Image: null filter_optional_programfiles: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump th. Logsource: windows / process_creation. Rule: title: Process Access via TrolleyExpress Exclusion id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6 status: test description: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.youtube.com/watch?v=Ie831jF0bb0 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2022-05-13 tags: - attack.stealth - attack.t1218.011 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \TrolleyExpress 7 - \TrolleyExpress 8 - \TrolleyExpress 9 - \TrolleyExpress.exe 7 - \TrolleyExpress.exe 8 - \TrolleyExpress.exe 9 - '\TrolleyExpress.exe -ma ' renamed: Image|endswith: \TrolleyExpress.exe filter_renamed: OriginalFileName|contains: CtxInstall filter_empty: OriginalFileName: null condition: selection or ( renamed and not 1 of filter* ) falsepositives: - Unknown level: high