Suspicious Volume Shadow Copy Vssapi.dll Load

{
  "image_load": {
    "EventID": 7,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "ImageLoaded
| endswith": "\\vssapi.dll"
  },
  "filter_main_windows": [
    {
      "Image": [
        "C:\\Windows\\explorer.exe",
        "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
        "C:\\Windows\\servicing\\TrustedInstaller.exe"
      ]
    },
    {
      "Image
| startswith": [
        "C:\\Windows\\System32\\",
        "C:\\Windows\\SysWOW64\\",
        "C:\\Windows\\Temp\\{",
        "C:\\Windows\\WinSxS\\",
        "C:\\$WinREAgent\\Scratch\\"
      ]
    }
  ],
  "filter_main_program_files": {
    "Image
| startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_main_null_image": {
    "Image": null
  },
  "filter_optional_programdata_packagecache": {
    "Image
| startswith": "C:\\ProgramData\\Package Cache\\"
  },
  "filter_optional_avira": {
    "Image
| contains
| all": [
      "\\temp\\is-",
      "\\avira_system_speedup.tmp"
    ]
  },
  "condition": "image_load and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Unknown