NtClearEvent

Prototype

NTSTATUS NtClearEvent(
  HANDLE  EventHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 3E 00 00 00      mov eax, 0x3E
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtClearEvent is the slimmest of the event-state-mutating syscalls: it only takes a handle, drops the event to non-signaled and returns NTSTATUS. Internally the kernel calls the same `KeResetEvent` routine as NtResetEvent — the only difference is that NtClearEvent discards the previous state instead of writing it back to userland, saving a probe and write to the `PreviousState` pointer. SSN `0x3E` has been frozen across every Windows 10/11 build. Most user-mode code reaches it indirectly via `ResetEvent` in Win32, which actually dispatches to NtClearEvent (not NtResetEvent) when the caller passes no out-pointer.

Common malware usage

Same role as NtResetEvent in *sleep-mask* and *event-paced* implant loops, picked when the caller doesn't need the previous state and wants the smallest syscall footprint. Some shellcode loaders prefer NtClearEvent over the Win32 `ResetEvent` precisely because it is one indirection less for an EDR user-mode hook to land on. Otherwise overwhelmingly legitimate.

Detection opportunities

Like NtResetEvent, NtClearEvent is high-volume legitimate traffic and not a signal on its own. The detection story is identical: look for tight `Set→Wait→Clear` loops out of unbacked memory, or out of threads whose only mapped image is suspicious. ETW does not separately surface clear vs reset. If you've already hooked NtResetEvent at the user-mode boundary, make sure NtClearEvent is hooked too — otherwise a one-line code swap defeats the hook.

Direct syscall examples

; Direct syscall stub for NtClearEvent (SSN 0x3E, stable Win10 1507+)
NtClearEvent PROC
    mov  r10, rcx          ; EventHandle
    mov  eax, 3Eh          ; SSN
    syscall
    ret
NtClearEvent ENDP

// One-shot reset; cheaper than ResetEvent because no PreviousState writeback.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtClearEvent)(HANDLE);

NTSTATUS ClearEvt(HANDLE hEvent) {
    pNtClearEvent fn = (pNtClearEvent)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtClearEvent");
    return fn(hEvent);
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1027Obfuscated Files or Informationmitre ↗