NtCreateMailslotFile

Prototype

NTSTATUS NtCreateMailslotFile(
  PHANDLE            FileHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  PIO_STATUS_BLOCK   IoStatusBlock,
  ULONG              CreateOptions,
  ULONG              MailslotQuota,
  ULONG              MaximumMessageSize,
  PLARGE_INTEGER     ReadTimeout
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 B9 00 00 00      mov eax, 0xB9
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Mailslots are a connectionless, one-way IPC — the *server* creates the slot via NtCreateMailslotFile and reads incoming datagrams; *clients* simply open `\\<host>\mailslot\<name>` with NtOpenFile/NtCreateFile and write to it. They predate named pipes and are implemented by mailslot.sys / mrxsmb.sys (cross-host delivery rides SMB). Messages can be broadcast to a domain-wide name (`\\*\mailslot\foo`), though that path is heavily restricted on modern domains. Maximum cross-network message size is 424 bytes; local-only mailslots can be much larger.

Common malware usage

Mailslots are an *OPSEC-favourable* IPC because almost no modern security stack inspects them. Cobalt Strike historically offered a mailslot SMB transport for beacon-to-beacon delivery — it's lower fidelity than named pipes but largely invisible to EDRs that hook NtCreateNamedPipeFile / FltMgr name-callbacks for pipes. Niche real-world use today: covert local IPC between cooperating implants in the same lateral-movement chain, where named pipes would draw immediate Sysmon Event 17/18 attention. Genuine modern named-malware-family use is rare; the asymmetric detection gap is the main draw.

Detection opportunities

Detection is genuinely sparse. Sysmon has no MailslotEvent (Events 17 / 18 cover named pipes only). ETW Microsoft-Windows-Kernel-File emits Create events with a `\Device\Mailslot\` path — write rules against that prefix in EDR file-create hooks. CmRegisterCallbackEx doesn't apply (no registry involvement); the right hookpoint is FltRegisterFilter against mailslot.sys's file system minifilter chain. Hunt query: any process creating an object under `\Device\Mailslot\` outside of `lsass.exe` (NETLOGON), `services.exe`, or `winlogon.exe` is worth investigating.

Direct syscall examples

// Creates \\.\mailslot\implant_chan as a passive receiver.
UNICODE_STRING name;
RtlInitUnicodeString(&name, L"\\??\\mailslot\\implant_chan");

OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

IO_STATUS_BLOCK iosb;
HANDLE hSlot = NULL;

NTSTATUS st = NtCreateMailslotFile(
    &hSlot,
    GENERIC_READ | SYNCHRONIZE,
    &oa,
    &iosb,
    0,        // CreateOptions
    0,        // MailslotQuota — system default
    1024,     // MaximumMessageSize
    NULL      // ReadTimeout — wait forever
);

NtCreateMailslotFile PROC
    mov  r10, rcx
    mov  eax, 0B9h
    syscall
    ret
NtCreateMailslotFile ENDP

// Cargo: windows-sys = "0.59" (Win32_Storage_FileSystem, Win32_Foundation)
use windows_sys::Win32::Storage::FileSystem::*;
let h = unsafe {
    CreateMailslotW(
        w!("\\\\.\\mailslot\\implant_chan"),
        1024,                       // nMaxMessageSize
        MAILSLOT_WAIT_FOREVER,      // lReadTimeout
        null_mut(),                 // lpSecurityAttributes
    )
};
// CreateMailslotW funnels into NtCreateMailslotFile.

MITRE ATT&CK mappings

• T1559Inter-Process Communicationmitre ↗
• T1071Application Layer Protocolmitre ↗
• T1106Native APImitre ↗