Suspicious Volume Shadow Copy Vssapi.dll Load by Uncommon Executables
This rule detects the loading of the 'vssapi.dll' library by executables that are not commonly associated with legitimate Volume Shadow Copy operations. Adversaries often interact with Volume Shadow Copy Service (VSS) DLLs to delete shadow copies, which is a common technique to inhibit system recovery and prevent data restoration after ransomware attacks or data destruction.
Sigma
