Rebuild Performance Counter Values Via Lodctr.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Known false positives

Legitimate usage by an administrator

MITRE ATT&CK coverage

Tactic	Techniques
Execution	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Rebuild Performance Counter Values Via Lodctr.EXE
id: cc9d3712-6310-4320-b2df-7cb408274d53
status: test
description: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.
references:
    - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-15
modified: 2024-03-05
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\lodctr.exe'
        OriginalFileName: 'LODCTR.EXE'
    selection_cli:
        CommandLine|contains|windash: ' -r'
    condition: all of selection_*
falsepositives:
    - Legitimate usage by an administrator
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    Image|endswith: '\lodctr.exe'
    OriginalFileName: 'LODCTR.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|windash: ' -r'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-r` transforms: `windash` corpus 4 (sigma 3, splunk 1)	`field:"CommandLine" kind:match value:" -r"`
`Image`	ends_with	`\lodctr.exe`	`field:"Image" kind:ends_with value:"\lodctr.exe"`
`OriginalFileName`	eq	`LODCTR.EXE`	`field:"OriginalFileName" kind:eq value:"LODCTR.EXE"`