Windows: Detect lodctr.exe Rebuild (-r) Performance Counter Values
Flags lodctr.exe executions with -r, indicating attempts to rebuild performance counter registry values.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-15
- Updated
- 2026-07-31
What it detects
This rule flags process executions of lodctr.exe where the command line includes the rebuild switch (-r). Rebuilding performance counter values can be leveraged to alter performance counter configuration and hinder monitoring or security tooling. It relies on Windows process creation telemetry capturing the executable name and command-line arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-lodctr-exe-rebuilds-performance-counter-registry-values-cc9d3712
title: "Windows: Detect lodctr.exe Rebuild (-r) Performance Counter Values"
id: 90044431-4595-4d6d-9db6-52d85cfeb8a0
status: test
description: This rule flags process executions of lodctr.exe where the command line includes the rebuild switch (-r). Rebuilding performance counter values can be leveraged to alter performance counter configuration and hinder monitoring or security tooling. It relies on Windows process creation telemetry capturing the executable name and command-line arguments.
references:
- https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lodctr_performance_counter_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-15
modified: 2024-03-05
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \lodctr.exe
OriginalFileName: LODCTR.EXE
selection_cli:
CommandLine|contains|windash: " -r"
condition: all of selection_*
falsepositives:
- Legitimate usage by an administrator
level: medium
license: DRL-1.1
related:
- id: cc9d3712-6310-4320-b2df-7cb408274d53
type: derived