NtAdjustPrivilegesToken

Prototype

NTSTATUS NtAdjustPrivilegesToken(
  HANDLE            TokenHandle,
  BOOLEAN           DisableAllPrivileges,
  PTOKEN_PRIVILEGES NewState,
  ULONG             BufferLength,
  PTOKEN_PRIVILEGES PreviousState,
  PULONG            ReturnLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 41 00 00 00      mov eax, 0x41
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtAdjustPrivilegesToken is what `advapi32!AdjustTokenPrivileges` wraps. A subtle but critical behaviour: the function returns `STATUS_SUCCESS` (`0`) even when one or more requested privileges were *not* held — callers must check `GetLastError() == ERROR_NOT_ALL_ASSIGNED` (or `STATUS_NOT_ALL_ASSIGNED` from NTSTATUS). Failing to do so produces silent privilege-escalation bugs in defensive tooling. The SSN has been **stable at `0x41`** from Windows 10 1507 through Windows 11 24H2, making it a popular pick for hardcoded SSN tables.

Common malware usage

The mandatory step before any cross-process token manipulation: enable SeDebugPrivilege so the implant can `NtOpenProcess` LSASS or other protected services. Other privileges commonly enabled by malware: SeImpersonatePrivilege (required by the Potato family for token impersonation), SeAssignPrimaryTokenPrivilege (required by `CreateProcessWithTokenW`), SeTcbPrivilege (LSASS-grade), SeBackupPrivilege / SeRestorePrivilege (registry hive theft for SAM/SYSTEM dumps as in `reg save HKLM\SAM`). Mimikatz' `privilege::debug` is literally a wrapper around this syscall.

Detection opportunities

Windows Security Event ID **4703** (Token Right Adjusted) records every successful privilege adjustment, including which privileges were enabled and the calling process. Event 4672 (Special Privileges Assigned) fires at logon and again when sensitive privileges (SeDebug, SeTcb, SeImpersonate, SeAssignPrimaryToken, SeLoadDriver, SeBackup, SeRestore, SeTakeOwnership, SeCreateToken) are enabled in any new process. Correlating 4703 + subsequent 4663/4673 against LSASS is a very high-fidelity pattern for credential-dumping detection. ETW provider `Microsoft-Windows-Kernel-Audit-API-Calls` also covers it.

Direct syscall examples

NtAdjustPrivilegesToken PROC
    mov  r10, rcx
    mov  eax, 41h          ; SSN stable across all builds
    syscall
    ret
NtAdjustPrivilegesToken ENDP

// Enable SeDebugPrivilege via direct Nt* calls — required before opening LSASS.
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tp = { 0 };

NtOpenProcessTokenEx(NtCurrentProcess(),
                    TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,
                    0, &hToken);

LookupPrivilegeValueW(NULL, L"SeDebugPrivilege", &luid);
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

NTSTATUS s = NtAdjustPrivilegesToken(hToken,
                                     FALSE,
                                     &tp,
                                     0, NULL, NULL);
// IMPORTANT: also test STATUS_NOT_ALL_ASSIGNED (0x06000000+) — success isn't enough.
if (s == 0x00000106 /* STATUS_NOT_ALL_ASSIGNED */) {
    // Privilege wasn't held — abort the elevation chain.
}

// Tiny helper used right after NtOpenProcessTokenEx, before NtDuplicateToken.
use windows_sys::Win32::Foundation::{HANDLE, LUID};
use windows_sys::Win32::Security::{LookupPrivilegeValueW, TOKEN_PRIVILEGES, SE_PRIVILEGE_ENABLED};

pub unsafe fn enable_privilege(token: HANDLE, name: &str) -> bool {
    let wide: Vec<u16> = name.encode_utf16().chain(std::iter::once(0)).collect();
    let mut luid: LUID = std::mem::zeroed();
    if LookupPrivilegeValueW(std::ptr::null(), wide.as_ptr(), &mut luid) == 0 {
        return false;
    }
    let mut tp = TOKEN_PRIVILEGES {
        PrivilegeCount: 1,
        Privileges: [windows_sys::Win32::Security::LUID_AND_ATTRIBUTES {
            Luid: luid,
            Attributes: SE_PRIVILEGE_ENABLED,
        }],
    };
    // Direct syscall stub elsewhere; signature matches NtAdjustPrivilegesToken.
    extern "system" { fn NtAdjustPrivilegesToken(
        h: HANDLE, disable_all: u8,
        new_state: *mut TOKEN_PRIVILEGES, len: u32,
        prev: *mut TOKEN_PRIVILEGES, ret_len: *mut u32) -> i32; }
    let s = NtAdjustPrivilegesToken(token, 0, &mut tp, 0, std::ptr::null_mut(), std::ptr::null_mut());
    // STATUS_NOT_ALL_ASSIGNED == 0x00000106 — treat as failure for elevation.
    s == 0
}

MITRE ATT&CK mappings

• T1134Access Token Manipulation
• T1134.001Token Impersonation/Theft
• T1003OS Credential Dumping
• T1106Native API