NtAlertThreadByThreadId

Prototype

NTSTATUS NtAlertThreadByThreadId(
  HANDLE ThreadId
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 71 00 00 00      mov eax, 0x71
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Introduced in Windows 8 and used heavily from Windows 10 onward as the kernel underpinning of `WakeByAddressSingle` / `WakeByAddressAll`. Together with `NtWaitForAlertByThreadId`, this pair implements per-thread alerts that do *not* require a named kernel object (no Event, no Mutex, no Semaphore). The synchronization state is purely a user-mode address that the kernel hashes into a per-process wait table; the kernel only needs the destination TID and uses no object-manager lookups, making the dispatch path very cheap. Slim Reader/Writer locks, the new `WaitOnAddress`, and the modern condition-variable implementation in ntdll all sit on top of this primitive.

Common malware usage

Low-signal sync for sleep masks, beacon scheduling and command pumps. Because there is no kernel object created or named, there are no `\BaseNamedObjects\…` artifacts for tools like ProcessHacker / SystemInformer to surface — which is the main appeal over `NtSetEvent` / `NtWaitForSingleObject`. A few Cobalt-Strike-derived sleep-mask variants and the more recent Sliver scheduling backends use `WaitOnAddress` (and hence this syscall) to park worker threads between beacon cycles. As of mid-2026 it remains a relatively *low-malware-signal* syscall: the same code path is exercised by every modern Win32 program that uses SRWLOCK or std::mutex on MSVC, so the volume of legitimate calls swamps any malicious use.

Detection opportunities

Effectively undetectable on its own — `NtAlertThreadByThreadId` is invoked by SRWLOCK release, condition-variable wake, and any C++17/20 `std::mutex` unlock that finds a waiter. EDRs do not hook it because the noise floor is enormous. The only useful detection angle is the *combination* with sleep-mask telemetry: short, periodic NtWaitForAlertByThreadId returns coupled with NtAlertThreadByThreadId from a single non-system thread, on a process that also performs network beaconing, *plus* an RX-only code region — there the syscall is a corroborating signal, never a primary one.

Direct syscall examples

// Replace SetEvent on a globally named event with WaitOnAddress/WakeByAddressSingle
// to avoid creating an object visible to handle-listers.
typedef NTSTATUS(NTAPI* fnNtAlertThreadByThreadId)(HANDLE);

void PokeWorker(DWORD workerTid) {
    HMODULE n = GetModuleHandleA("ntdll.dll");
    fnNtAlertThreadByThreadId p = (fnNtAlertThreadByThreadId)
        GetProcAddress(n, "NtAlertThreadByThreadId");
    p((HANDLE)(ULONG_PTR)workerTid);
}

; SSN 0x71 on win11-24h2 / winserver-2025. 0x70 on most prior 20H2+ builds.
NtAlertThreadByThreadId PROC
    mov  r10, rcx
    mov  eax, 71h
    syscall
    ret
NtAlertThreadByThreadId ENDP

// Wake a worker parked in NtWaitForAlertByThreadId without ever instantiating
// a named kernel object. Useful in implants that want to look like a normal
// Win32 program using SRWLOCK.
use windows_sys::Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress};

type NtAlertThreadByThreadId = unsafe extern "system" fn(tid: isize) -> i32;

pub unsafe fn wake_worker(tid: u32) -> i32 {
    let n = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let addr = GetProcAddress(n, b"NtAlertThreadByThreadId\0".as_ptr()).unwrap();
    let f: NtAlertThreadByThreadId = std::mem::transmute(addr);
    f(tid as isize)
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1027Obfuscated Files or Informationmitre ↗