CmdID

CmdID / Commands

logman

Creates and manages Event Trace Session and Performance logs and supports many functions of Performance Monitor from the command line. Windows commands reference

On Windows 2 Sigma rules name it 4 sub-commands File logman.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0
logman [create | query | start | stop | delete| update | import | export | /?] [options]
logman createCreates a counter, trace, configuration data collector, or API.
logman queryQueries data collector properties.
logman start | stopStarts or stops data collection.
logman deleteDeletes an existing data collector.
logman updateUpdates the properties of an existing data collector.
logman import | exportImports a data collector set from an XML file or export a data collector set to an XML file.

What detects it

Sigma process creation rules that name logman
highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
highSuspicious Windows Trace ETW Session Tamper Via Logman.EXEFlorian Roth (Nextron Systems)

Sub-commands

each with its page
logman createlogman deletelogman querylogman update