NtAccessCheck

Prototype

NTSTATUS NtAccessCheck(
  PSECURITY_DESCRIPTOR SecurityDescriptor,
  HANDLE               ClientToken,
  ACCESS_MASK          DesiredAccess,
  PGENERIC_MAPPING     GenericMapping,
  PPRIVILEGE_SET       PrivilegeSet,
  PULONG               PrivilegeSetLength,
  PACCESS_MASK         GrantedAccess,
  PNTSTATUS            AccessStatus
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 00 00 00 00      mov eax, 0x00
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtAccessCheck holds the literal first slot in the System Service Descriptor Table — SSN `0x0` on every Windows build since NT 4 — which makes it a delightful curiosity but useless as an offensive primitive. It is the user-mode entrypoint for *manual* access-check logic: a service that has just impersonated a client uses NtAccessCheck (typically via the Win32 AccessCheck wrapper) to decide whether the client *would* be allowed to perform an operation against a resource the service controls. It does not itself open anything — it is a pure evaluation function over a SECURITY_DESCRIPTOR + token + GENERIC_MAPPING.

Common malware usage

Almost never used for offense directly. The two patterns that do show up: (1) post-exploitation tools enumerating which DACL'd objects a stolen impersonation token can reach without actually opening them (silent reconnaissance — no audit fires unless SACLs are configured); (2) exploit code that probes whether a forged or relogged token grants the intended access. Honest assessment: NtAccessCheck is dominated by legitimate usage and is a weak malware signal.

Detection opportunities

Almost no useful telemetry exists. NtAccessCheck does not itself trigger object-access auditing (Event ID 4663) — only the subsequent open does. ETW Microsoft-Windows-Security-Auditing's privilege-use events can fire if the call references a SACL-bearing object during evaluation, but coverage is sparse. Useful as a *correlation* signal: an unusual process performing many NtAccessCheck calls back-to-back against varied security descriptors, followed by selective NtOpen* calls only on the ones that succeeded, is a classic silent-reconnaissance pattern.

Direct syscall examples

; Direct syscall stub for NtAccessCheck (SSN 0x00 on every Windows build)
NtAccessCheck PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 0            ; SSN
    syscall
    ret
NtAccessCheck ENDP

// After ImpersonateNamedPipeClient / RpcImpersonateClient, the service evaluates
// whether the caller would be allowed FILE_WRITE_DATA on a private resource.
HANDLE hClientToken = NULL;
NtOpenThreadToken(NtCurrentThread(), TOKEN_QUERY, FALSE, &hClientToken);

GENERIC_MAPPING fileMapping = {
    .GenericRead    = FILE_GENERIC_READ,
    .GenericWrite   = FILE_GENERIC_WRITE,
    .GenericExecute = FILE_GENERIC_EXECUTE,
    .GenericAll     = FILE_ALL_ACCESS,
};

BYTE privBuf[256];
ULONG privLen = sizeof(privBuf);
ACCESS_MASK granted = 0;
NTSTATUS accessStatus = 0;

NtAccessCheck(pResourceSD,
              hClientToken,
              FILE_WRITE_DATA,
              &fileMapping,
              (PPRIVILEGE_SET)privBuf,
              &privLen,
              &granted,
              &accessStatus);

if (NT_SUCCESS(accessStatus) && (granted & FILE_WRITE_DATA)) {
    // proceed under impersonation
}

// Cargo: windows-sys = "0.59"  (Win32_Security)
use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_access_check_stub() {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x00",
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1087Account Discoverymitre ↗