NtCloseObjectAuditAlarm

Prototype

NTSTATUS NtCloseObjectAuditAlarm(
  PUNICODE_STRING SubsystemName,
  PVOID           HandleId,
  BOOLEAN         GenerateOnClose
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 3B 00 00 00      mov eax, 0x3B
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Generates Security event 4658 ("The handle to an object was closed"). It must be invoked when a prior NtAccessCheck*AuditAlarm call returned GenerateOnClose=TRUE, so the open/close pair is correctly correlated in the Security log. The function is *not* called automatically by NtClose — the audited subsystem (LSASS, the SAM, the SCM, third-party SACL-aware services) is responsible for the bookkeeping. Missing close events for a known-open audited handle indicate either an unclean process exit (handle reaped by the kernel without subsystem notification) or active log tampering. SSN `0x3B` has been stable since Windows 10 1507.

Common malware usage

Effectively none. The syscall is a logging primitive — calling it adds Security-log entries, the opposite of what malware wants. No commodity family is observed invoking it. The interesting direction is the *missing* 4658: a 4656 (open) without its matching 4658 in the same session is a high-confidence indicator of audit-subsystem disruption (often via stopping the EventLog service or overflowing the channel with NtFlushKey + registry pressure).

Detection opportunities

Pair every 4656 (handle requested with SACL-monitored access) with a 4658 (handle closed). The lag distribution is dominated by short-lived handles (< 1s for files, < 100ms for registry keys). Persistent 4656-without-4658 on SACL'd objects (LSASS process, AdminSDHolder, Defender registry keys) is a strong tampering signal. Sysmon Event ID 13 (registry value set) and 16 (Sysmon config changed) plus EVENT_TRACE_FLAG_REGISTRY ETW give parallel telemetry that doesn't depend on the Security channel itself.

Direct syscall examples

; Direct syscall stub for NtCloseObjectAuditAlarm (SSN 0x3B, Win10 1507+)
NtCloseObjectAuditAlarm PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 3Bh          ; SSN
    syscall
    ret
NtCloseObjectAuditAlarm ENDP

// Bookkeeping pattern used by SACL-aware services.
UNICODE_STRING sub = RTL_CONSTANT_STRING(L"Security");
BOOLEAN gen_on_close = FALSE;
ACCESS_MASK granted = 0;
NTSTATUS access_status = STATUS_ACCESS_DENIED;

NtAccessCheckByTypeAndAuditAlarm(
    &sub, (PVOID)hHandleId,
    &type_name, &obj_name,
    pSd, NULL,
    FILE_GENERIC_READ,
    AuditEventObjectAccess, 0,
    pObjectTypeList, otl_len,
    &g_FileMapping, FALSE,
    &granted, &access_status, &gen_on_close);

// ... use the handle ...

if (gen_on_close) {
    NtCloseObjectAuditAlarm(&sub, (PVOID)hHandleId, TRUE);
    // -> Security event 4658 with the same HandleId for correlation.
}
NtClose(hFile);

use windows_sys::Win32::Security::Authorization::ObjectCloseAuditAlarmW;

unsafe {
    let ok = ObjectCloseAuditAlarmW(
        windows_sys::w!("Security"),
        handle_id as *mut _,
        gen_on_close as i32,
    );
    // ok != 0 -> 4658 emitted.
}

MITRE ATT&CK mappings

• T1562.002Impair Defenses: Disable Windows Event Loggingmitre ↗
• T1106Native APImitre ↗