NtAccessCheckByTypeResultList

Prototype

NTSTATUS NtAccessCheckByTypeResultList(
  PSECURITY_DESCRIPTOR  SecurityDescriptor,
  PSID                  PrincipalSelfSid,
  HANDLE                ClientToken,
  ACCESS_MASK           DesiredAccess,
  POBJECT_TYPE_LIST     ObjectTypeList,
  ULONG                 ObjectTypeListLength,
  PGENERIC_MAPPING      GenericMapping,
  PPRIVILEGE_SET        PrivilegeSet,
  PULONG                PrivilegeSetLength,
  PACCESS_MASK          GrantedAccessList,
  PNTSTATUS             AccessStatusList
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 64 00 00 00      mov eax, 0x64
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Like NtAccessCheckByType but returns a *vector* of access decisions — one entry per ObjectTypeList element — instead of a single composite verdict. The canonical use case is Active Directory: a single attempt to read a user object can simultaneously require evaluation of the object itself plus several property-set ACEs (e.g. Personal-Information, Public-Information, Account-Restrictions). The result list lets the caller report exactly which property set was denied. SSN `0x64` has been stable across every supported Windows build since 1507. There is no audit-emission side effect — pair with NtAccessCheckByTypeResultListAndAuditAlarm when the SACL demands logging.

Common malware usage

Effectively none. The function is consumed by LSASS, NTDS, and the SAM/AD-aware components; commodity malware has no reason to perform structured AD-style ACL checks. The malware angle is inverse: attackers query AD ACLs (BloodHound, PowerView) to *avoid* operations that would trip audit-alarm checks elsewhere.

Detection opportunities

On a domain controller the call rate is dominated by ntdsa.dll inside lsass.exe. Anomalous callers (anything not in {lsass.exe, services.exe, an MS-signed AD service}) are worth flagging via ETW Microsoft-Windows-Kernel-Audit-API-Calls. On a workstation the call is rare outside of LSASS-side credential validation paths; uncommon images calling it warrants investigation.

Direct syscall examples

; Direct syscall stub for NtAccessCheckByTypeResultList (SSN 0x64, Win10 1507+)
NtAccessCheckByTypeResultList PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 64h          ; SSN
    syscall
    ret
NtAccessCheckByTypeResultList ENDP

// Evaluate read access against an AD user object plus two property sets.
OBJECT_TYPE_LIST otl[3] = {
    { ACCESS_OBJECT_GUID, 0, &GUID_USER_OBJECT },             // level 0
    { ACCESS_PROPERTY_SET_GUID, 0, &GUID_PERSONAL_INFO },    // level 1
    { ACCESS_PROPERTY_SET_GUID, 0, &GUID_PUBLIC_INFO },      // level 1
};
ACCESS_MASK granted[3] = {0};
NTSTATUS    statuses[3] = {0};
PRIVILEGE_SET privs;
ULONG       privs_len = sizeof privs;

NTSTATUS rc = NtAccessCheckByTypeResultList(
    pSd, NULL, hClientToken,
    READ_CONTROL | ADS_RIGHT_DS_READ_PROP,
    otl, ARRAYSIZE(otl),
    &g_DsGenericMapping,
    &privs, &privs_len,
    granted, statuses);

// Inspect statuses[0..2] to report which property set was denied.

MITRE ATT&CK mappings

• T1106Native APImitre ↗