NtCreateJobObject

Prototype

NTSTATUS NtCreateJobObject(
  PHANDLE            JobHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 B4 00 00 00      mov eax, 0xB4
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtCreateJobObject allocates a `_EJOB` kernel structure and returns a handle. On its own it does nothing observable: the object becomes meaningful once processes are assigned to it via NtAssignProcessToJobObject and policy is applied through NtSetInformationJobObject. Job objects underpin Windows sandboxing — Chromium / Edge renderers, AppContainer / Windows Sandbox, and modern Win32 child-process management all sit on top of jobs. Nested jobs (Win8+) make it possible to layer policy without breaking earlier assignments. The SSN drifts every couple of feature updates.

Common malware usage

Almost entirely benign. The interesting offensive pattern is the reverse — *escaping* a job via PROCESS_CREATE_FLAGS_BREAKAWAY_FROM_JOB on a child spawn (when the job permits) or by terminating the controlling process so the JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE policy fires and removes evidence. A small number of red-team tools create their own job to apply JobObjectExtendedLimitInformation with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE to a stager so it self-destructs if the implant exits. This is a weak offensive signal — be honest, jobs are everywhere on a healthy system.

Detection opportunities

Sysmon does not have a dedicated job-object event today. Useful telemetry comes from ETW Microsoft-Windows-Kernel-Process (process-start records expose the job ID via TokenInformation) and from EDR hooks on ntdll!NtCreateJobObject combined with ntdll!NtAssignProcessToJobObject. The blue-team angle is not `who created a job` (everything does) but `who created a job that included a process they did not spawn` — a sign of attempted containment or termination control. Pair with NtSetInformationJobObject(JobObjectExtendedLimitInformation) to flag KILL_ON_JOB_CLOSE on unusual jobs.

Direct syscall examples

; Direct syscall stub for NtCreateJobObject (SSN 0xB4 on Win11 24H2 / Server 2025)
NtCreateJobObject PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 0B4h         ; SSN for win11-24h2
    syscall
    ret
NtCreateJobObject ENDP

// First step of a sandboxed child-process pattern.
// Pair with NtAssignProcessToJobObject + NtSetInformationJobObject to fully wire it up.
HANDLE hJob = NULL;
NTSTATUS s = NtCreateJobObject(&hJob,
                               JOB_OBJECT_ALL_ACCESS,
                               NULL);   // anonymous, unnamed
if (!NT_SUCCESS(s)) return s;

// At this point hJob is empty; nothing happens to any process until
// NtAssignProcessToJobObject(hJob, hChild) is called.

// Cargo: windows-sys = "0.59"  (Win32_System_JobObjects)
use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_create_job_object_stub() {
    asm!(
        "mov r10, rcx",
        "mov eax, 0xB4",    // Win11 24H2; resolve dynamically for other builds
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1564Hide Artifactsmitre ↗