NtCreatePort

Prototype

NTSTATUS NtCreatePort(
  PHANDLE             PortHandle,
  POBJECT_ATTRIBUTES  ObjectAttributes,
  ULONG               MaxConnectionInfoLength,
  ULONG               MaxMessageLength,
  ULONG               MaxPoolUsage
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 BE 00 00 00      mov eax, 0xBE
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtCreatePort is the *server* side of the legacy **LPC** IPC mechanism (pre-Vista). It registers a named port object — typically under `\RPC Control\` — that clients reach via NtConnectPort. After accepting a connection with NtAcceptConnectPort and completing the handshake with NtCompleteConnectPort, the server enters its receive loop using NtReplyWaitReceivePort. Since Vista, the kernel exposes the richer **ALPC** API (NtAlpcCreatePort etc.) and Microsoft has migrated almost all in-box RPC traffic to ALPC. LPC remains in the Service Descriptor Table for backwards compatibility but is rarely used by anything shipping today.

Common malware usage

Modern offensive use of NtCreatePort is *uncommon*. The relevant historical pattern is a kernel- or user-mode implant that registers an LPC port name mimicking a legitimate kernel component (e.g. something resembling `\SeLsaCommandPort`) and uses it as a covert intra-host C2 channel that never touches Winsock or named-pipe APIs. Today an attacker who wants in-host IPC will almost always reach for ALPC, named pipes, mailslots or shared sections instead. Treat any non-Microsoft-signed process invoking NtCreatePort as anomalous.

Detection opportunities

There is no dedicated ETW provider for legacy LPC equivalent to `Microsoft-Windows-Kernel-ALPC`. Detection therefore relies on kernel callbacks (object-manager ObCreateObject hooks via ObRegisterCallbacks for type `Port`) or driver-level syscall hooking. SystemInformer and WinObj enumerate live port objects under `\RPC Control` and `\Sessions\<n>\Windows`. Any new port name that doesn't match a known Microsoft component (csrss, lsass, smss, RPC subsystem) is worth investigating.

Direct syscall examples

; Direct syscall stub for NtCreatePort (SSN 0xBE on Win11 24H2)
NtCreatePort PROC
    mov  r10, rcx          ; PortHandle
    mov  eax, 0BEh         ; SSN — verify per-build before deploying
    syscall
    ret
NtCreatePort ENDP

// Create an LPC server port under \RPC Control.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtCreatePort)(
    PHANDLE, POBJECT_ATTRIBUTES, ULONG, ULONG, ULONG);

NTSTATUS CreateLpcPort(HANDLE *outHandle, PCWSTR ntName) {
    UNICODE_STRING name;
    OBJECT_ATTRIBUTES oa;
    RtlInitUnicodeString(&name, ntName);
    InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

    pNtCreatePort fn = (pNtCreatePort)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtCreatePort");
    return fn(outHandle, &oa, 0x100, 0x100, 0x2000);
}

MITRE ATT&CK mappings

• T1559Inter-Process Communicationmitre ↗
• T1106Native APImitre ↗