NtCompareTokens

Prototype

NTSTATUS NtCompareTokens(
  HANDLE   FirstTokenHandle,
  HANDLE   SecondTokenHandle,
  PBOOLEAN Equal
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 A1 00 00 00      mov eax, 0xA1
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Compares the *effective* access decision of two tokens, not raw token identity. The kernel routine SepCompareTokens walks both tokens' User SID, Groups, RestrictedSids and Privileges arrays and returns Equal=TRUE only when each set matches element-for-element. The MandatoryPolicy, integrity level and impersonation level are not part of the comparison — two tokens at different integrity levels can therefore compare equal. Microsoft documents the API mainly for security software that needs to know whether two impersonation tokens are interchangeable (e.g. should a cached resource handle still be valid). It is one of the lower-traffic token syscalls — a typical workstation issues only a handful per minute, mostly from svchost.exe and lsass.exe.

Common malware usage

Rare in offensive use; almost always seen in defensive software. Browsers (Edge, Chrome) call it via `CompareObjectHandles` to verify that a sandboxed renderer's token still matches the one the broker minted, defending against token-swap attacks during IPC. AppContainer hosts use it to validate child-token continuity. The handful of malicious uses are reconnaissance: an implant duplicates several tokens it has captured and compares them to detect duplicates or to deduplicate impersonation candidates before attempting `SetThreadToken`. There is essentially no canonical offensive recipe.

Detection opportunities

Largely a *non-detection* — the legitimate callers (lsass.exe, MsMpEng.exe, RuntimeBroker.exe, msedge.exe) dominate. A non-system process calling `NtCompareTokens` on two tokens it just acquired via `NtOpenProcessToken` against unrelated processes is a weak credential-recon signal, best paired with `NtDuplicateToken` and `NtImpersonateAnonymousToken` telemetry. There is no dedicated ETW Threat-Intelligence event; rely on EDR hooks of `ntdll!NtCompareTokens` filtered by `actor_image NOT IN (browser/AV/runtime brokers)`.

Direct syscall examples

// Pattern used by AppContainer hosts: a broker reopens the renderer's token
// and confirms it still matches the one it issued, defending against an attacker
// who swapped the renderer's primary token via cross-process injection.
typedef NTSTATUS(NTAPI* fnNtCompareTokens)(HANDLE, HANDLE, PBOOLEAN);

BOOL TokenStillMine(HANDLE issued, HANDLE currentRendererToken) {
    HMODULE n = GetModuleHandleA("ntdll.dll");
    fnNtCompareTokens p = (fnNtCompareTokens)GetProcAddress(n, "NtCompareTokens");
    BOOLEAN eq = FALSE;
    return p(issued, currentRendererToken, &eq) == 0 && eq;
}

; SSN 0xA1 on win11-24h2 / winserver-2025.
NtCompareTokens PROC
    mov  r10, rcx
    mov  eax, 0A1h
    syscall
    ret
NtCompareTokens ENDP

// Implant collected N tokens via NtOpenProcessToken. Before bothering to
// SetThreadToken into each, drop duplicates that grant the same access.
use windows_sys::Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress};

type NtCompareTokens = unsafe extern "system" fn(a: isize, b: isize, eq: *mut u8) -> i32;

pub unsafe fn dedup_tokens(mut tokens: Vec<isize>) -> Vec<isize> {
    let n = GetModuleHandleA(b"ntdll.dll\0".as_ptr());
    let addr = GetProcAddress(n, b"NtCompareTokens\0".as_ptr()).unwrap();
    let f: NtCompareTokens = std::mem::transmute(addr);
    let mut out: Vec<isize> = Vec::new();
    for t in tokens.drain(..) {
        let mut is_dup = false;
        for &kept in &out {
            let mut eq: u8 = 0;
            if f(t, kept, &mut eq) == 0 && eq != 0 { is_dup = true; break; }
        }
        if !is_dup { out.push(t); }
    }
    out
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗