Windows: Lodctr.EXE Rebuilds Performance Counter Registry Values

Flags lodctr.exe executions with -r, indicating attempts to rebuild performance counter registry values.

FreeUnreviewedSigmamediumv1

windows-lodctr-exe-rebuilds-performance-counter-registry-values-cc9d3712

title: "Windows: Lodctr.EXE Rebuilds Performance Counter Registry Values"
id: 90044431-4595-4d6d-9db6-52d85cfeb8a0
status: test
description: This rule identifies process executions of lodctr.exe where the command line contains the -r option to rebuild performance counter registry values. Attackers can abuse this mechanism by supplying a configuration that overwrites performance counter settings, potentially disrupting detection and monitoring. Telemetry relies on Windows process creation events, including the image name and command-line arguments.
references:
  - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lodctr_performance_counter_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-15
modified: 2024-03-05
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \lodctr.exe
    OriginalFileName: LODCTR.EXE
  selection_cli:
    CommandLine|contains|windash: " -r"
  condition: all of selection_*
falsepositives:
  - Legitimate usage by an administrator
level: medium
license: DRL-1.1
related:
  - id: cc9d3712-6310-4320-b2df-7cb408274d53
    type: derived

What it detects

This rule identifies process executions of lodctr.exe where the command line contains the -r option to rebuild performance counter registry values. Attackers can abuse this mechanism by supplying a configuration that overwrites performance counter settings, potentially disrupting detection and monitoring. Telemetry relies on Windows process creation events, including the image name and command-line arguments.

Known false positives

Legitimate usage by an administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.