NtAlertResumeThread

Prototype

NTSTATUS NtAlertResumeThread(
  HANDLE  ThreadHandle,
  PULONG  PreviousSuspendCount
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 6F 00 00 00      mov eax, 0x6F
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Functionally `NtAlertResumeThread` is the fusion of `NtAlertThread` + `NtResumeThread` in a single round-trip. The kernel decrements the suspend count *and* sets the alert flag, so when the thread next reaches an alertable wait — or has a queued APC waiting — the APC dispatches immediately. The Win32 layer has no direct equivalent; `ResumeThread` does not set the alert bit. Phnt documents it; the public SDK does not.

Common malware usage

Used in APC-injection chains where the attacker needs both halves atomically — wake the thread and guarantee the APC fires the moment it begins executing. Many Early Bird and Atom-Bombing variants prefer `NtAlertResumeThread` over `NtResumeThread + NtTestAlert` because it removes a TOCTOU window in which an EDR could observe the resumed thread before APC delivery. It is the canonical resume primitive in modern sleep-mask kits (Ekko, Cronos) that suspend the beacon thread to encrypt memory and then need a single-syscall wakeup that fires the decryption APC.

Detection opportunities

Calls to `NtAlertResumeThread` from a process targeting a thread inside another process are noisy: cross-process resume is rare in normal software and is a strong injection indicator when combined with prior `NtQueueApcThread` on the same thread. Kernel callbacks `PsSetCreateThreadNotifyRoutineEx` plus ETW `Microsoft-Windows-Threat-Intelligence` capture remote thread state transitions. Detection rules in CarbonBlack and Elastic SIEM commonly flag the sequence `NtQueueApcThread → NtAlertResumeThread` cross-process as APC injection.

Direct syscall examples

; Direct syscall stub for NtAlertResumeThread (SSN 0x6F on Win11 24H2)
NtAlertResumeThread PROC
    mov  r10, rcx          ; ThreadHandle
    mov  eax, 6Fh          ; SSN
    syscall
    ret
NtAlertResumeThread ENDP

// Resume a suspended remote thread and atomically deliver the APC.
extern "C" NTSTATUS NTAPI NtQueueApcThread(HANDLE, PVOID, PVOID, PVOID, PVOID);
extern "C" NTSTATUS NTAPI NtAlertResumeThread(HANDLE, PULONG);

void InjectViaApc(HANDLE hThread, PVOID pShellcodeRX) {
    // 1. Queue user-APC pointing at our shellcode.
    NtQueueApcThread(hThread, pShellcodeRX, NULL, NULL, NULL);
    // 2. Atomically wake + alert; APC fires on next user-mode dispatch.
    ULONG prev = 0;
    NtAlertResumeThread(hThread, &prev);
}

use std::arch::asm;

#[unsafe(naked)]
pub unsafe extern "system" fn nt_alert_resume_thread(
    _thread: *mut core::ffi::c_void,
    _prev: *mut u32,
) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x6F",     // Win11 24H2 — resolve dynamically in production
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1055.004Asynchronous Procedure Callmitre ↗
• T1106Native APImitre ↗