CmdID

CmdID / Commands

lodctr

Allows you to register or save performance counter name and registry settings in a file and designate trusted services. Windows commands reference

On Windows 1 Sigma rule name it File lodctr.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0
lodctr <filename> [/s:<filename>] [/r:<filename>] [/t:<servicename>]
lodctr /s:"perf backup1.txt"
<filename>Specifies the name of the initialization file that registers the performance counter name settings and explanatory text.
/s:<filename>Specifies the name of the file to which the performance counter registry settings and explanatory text are saved.
/rRestores counter registry settings and explanatory text from current registry settings and cached performance files related to the registry.
/r:<filename>Specifies the name of the file that restores the performance counter registry settings and explanatory text. Warning: If you use this command, you'll overwrite all performance counter registry settings and explanatory text, replacing them with the configuration defined in the specified file.
/t:<servicename>Indicates that service <servicename> is trusted.
/?Displays help at the command prompt.

What detects it

Sigma process creation rules that name lodctr
mediumRebuild Performance Counter Values Via Lodctr.EXENasreddine Bencherchali (Nextron Systems)