NtAccessCheckByType

Prototype

NTSTATUS NtAccessCheckByType(
  PSECURITY_DESCRIPTOR  SecurityDescriptor,
  PSID                  PrincipalSelfSid,
  HANDLE                ClientToken,
  ACCESS_MASK           DesiredAccess,
  POBJECT_TYPE_LIST     ObjectTypeList,
  ULONG                 ObjectTypeListLength,
  PGENERIC_MAPPING      GenericMapping,
  PPRIVILEGE_SET        PrivilegeSet,
  PULONG                PrivilegeSetLength,
  PACCESS_MASK          GrantedAccess,
  PNTSTATUS             AccessStatus
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 63 00 00 00      mov eax, 0x63
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Extended cousin of `NtAccessCheck` that understands a *typed object hierarchy*. Where `NtAccessCheck` evaluates one DACL against one DesiredAccess, `NtAccessCheckByType` walks an `OBJECT_TYPE_LIST` (root → child types, identified by GUID) and may grant the requested access at the parent level while denying it at a specific child type — the model AD uses for fine-grained permissions like 'Read All Properties' versus 'Read PasswordLastSet'. Object-specific ACEs (`ACCESS_ALLOWED_OBJECT_ACE`, `ACCESS_DENIED_OBJECT_ACE`) carry a GUID matching one of the OBJECT_TYPE_LIST entries. The syscall number `0x63` is stable from Windows 10 1507 all the way through Server 2025 and Win11 24H2 — one of the most stable syscalls in the table.

Common malware usage

Weak malware signal — this is a self-service security primitive used by **server-side software**, not malware. It appears in Active Directory authorization paths (lsass.exe, dsamain.exe), in COM+/Component Services (catsrv.dll), in Authorization Manager (azroles.dll), and in some MS-SQL access broker code. Documented offensive uses are limited to: (1) AD privilege-mapping reconnaissance, where an attacker calls AccessCheckByType locally against the user's own token plus a domain-controller-fetched security descriptor to enumerate exactly which AD attributes the current principal can read/write — equivalent to BloodHound's user-rights collection but client-side and without network noise; (2) some COM-based UAC bypass research has used it to verify that an exploit chain actually flips a previously-denied access bit. There is no documented major-malware-family use as a primary primitive.

Detection opportunities

Telemetry signal is essentially zero for the syscall itself — too noisy in legitimate AD and COM+ workloads to alarm on. Defenders instead focus on: object-access auditing (Event ID 4663) at the resource owners (AD via 4662 'object operation', COM+ via Component Services audit), which fires *after* the AccessCheckByType decision. ETW Microsoft-Windows-Security-Auditing covers the AD-side audit category. For COM and Authorization Manager apps, custom AppLog ETW providers may emit access-check verdicts. From an EDR perspective, AccessCheckByType called by a non-server process targeting an AD object descriptor (recognizable from the GUIDs in the OBJECT_TYPE_LIST) is a weak BloodHound-style recon indicator.

Direct syscall examples

; Direct syscall stub for NtAccessCheckByType (SSN 0x63 stable across all builds)
NtAccessCheckByType PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 63h          ; SSN — stable everywhere
    syscall
    ret
NtAccessCheckByType ENDP

// AD authorization sample: the caller wants to read the 'unicodePwd' attribute
// on a user object. OBJECT_TYPE_LIST has the user class at level 0 and the
// attribute at level 1; AccessCheckByType returns per-level masks.
#include <windows.h>
#include <accctrl.h>
#include <aclapi.h>

BOOL CheckCanReadAttribute(PSECURITY_DESCRIPTOR sd, HANDLE clientToken,
                           const GUID* classGuid, const GUID* attrGuid)
{
    OBJECT_TYPE_LIST otl[2] = {
        { ACCESS_OBJECT_GUID, 0, (GUID*)classGuid },
        { ACCESS_PROPERTY_GUID, 0, (GUID*)attrGuid },
    };
    GENERIC_MAPPING gm = { 0x20094, 0x20028, 0, 0xF01FF };
    PRIVILEGE_SET ps; ULONG psLen = sizeof(ps);
    ACCESS_MASK granted = 0; BOOL accessStatus = FALSE;

    return AccessCheckByType(sd, NULL, clientToken, ACTRL_DS_READ_PROP,
        otl, 2, &gm, &ps, &psLen, &granted, &accessStatus) && accessStatus;
}

// Variant: caller passes its own impersonation token plus a DC-fetched SD
// for a target object and probes a list of attribute GUIDs to discover the
// effective rights without round-tripping LDAP queries to the DC.
#include <windows.h>
#include <stdio.h>

void EnumerateLocalRights(PSECURITY_DESCRIPTOR sd, HANDLE myToken,
                          const GUID* classGuid,
                          const GUID* attrGuids, size_t n)
{
    for (size_t i = 0; i < n; ++i) {
        if (CheckCanReadAttribute(sd, myToken, classGuid, &attrGuids[i])) {
            wprintf(L"+ readable attr %zu\n", i);
        }
    }
}

MITRE ATT&CK mappings

• T1087.002Account Discovery: Domain Accountmitre ↗
• T1069.002Permission Groups Discovery: Domain Groupsmitre ↗
• T1106Native APImitre ↗