Rebuild Performance Counter Values Via Lodctr.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•14

Detects the execution of 'lodctr.exe' with the '-r' flag, which is used to rebuild performance counter registry values. Attackers can abuse this utility by providing a malicious configuration file to overwrite performance counter configurations, potentially confusing or evading monitoring and security solutions.