NtAlpcRevokeSecurityContext

Prototype

NTSTATUS NtAlpcRevokeSecurityContext(
  HANDLE       PortHandle,
  ULONG        Flags,
  ALPC_HANDLE  ContextHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 8D 00 00 00      mov eax, 0x8D
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtAlpcRevokeSecurityContext` is the **soft-disable** to `NtAlpcDeleteSecurityContext`'s **destructor**. It flips a flag on the context entry so that any subsequent `NtAlpcImpersonateClientOfPort` referencing it fails with `STATUS_ALPC_HANDLE_REVOKED`, but the entry stays valid until the natural delete. Two reasons a server would prefer revoke over delete: (1) the same handle is still referenced by in-flight `PORT_MESSAGE`s and a delete would race; (2) the server wants to log which messages tried to use the now-invalid token. The kernel sets `AlpcSecurityContext->Revoked` and lets the reference count drop to zero naturally, at which point the underlying token reference is released.

Common malware usage

Almost no offensive interest — it is *less* powerful than `NtAlpcDeleteSecurityContext` (no UAF risk, no immediate freeing). A red-team operator who has compromised a privileged ALPC server might revoke an existing context to **deny service** to a specific client (a noisy EDR agent, for example) without dropping the whole connection — surgical degradation rather than tear-down. Otherwise the syscall is invoked only as part of normal RPC server cleanup.

Detection opportunities

Functionally invisible to defenders — revocation has no externally observable effect except that a subsequent impersonation will fail with `STATUS_ALPC_HANDLE_REVOKED`, which is normal during shutdown. Treat anomalies the same way as for `NtAlpcDeleteSecurityContext`: look at the **pattern** (frequent revoke-then-create cycles on the same port suggests a fuzzer or a TOCTOU prober), not the syscall itself. The Microsoft-Windows-Kernel-ALPC ETW provider records the call when enabled.

Direct syscall examples

// Mark a cached client context as revoked without disturbing in-flight messages.
// Later, NtAlpcDeleteSecurityContext finishes the job when the ref-count is zero.
#include <windows.h>
#include <winternl.h>

typedef PVOID ALPC_HANDLE;
NTSTATUS NTAPI NtAlpcRevokeSecurityContext(HANDLE, ULONG, ALPC_HANDLE);

void SoftRevoke(HANDLE serverPort, ALPC_HANDLE ctx) {
    // After this call, NtAlpcImpersonateClientOfPort referencing ctx returns
    // STATUS_ALPC_HANDLE_REVOKED instead of impersonating.
    NtAlpcRevokeSecurityContext(serverPort, 0, ctx);
}

; Direct syscall stub for NtAlpcRevokeSecurityContext (SSN 0x8D on Win11 24H2 / Server 2025)
NtAlpcRevokeSecurityContext PROC
    mov  r10, rcx          ; PortHandle
    mov  eax, 8Dh          ; SSN
    syscall
    ret
NtAlpcRevokeSecurityContext ENDP

MITRE ATT&CK mappings

• T1559Inter-Process Communicationmitre ↗
• T1106Native APImitre ↗