NtCreateSection

Prototype

NTSTATUS NtCreateSection(
  PHANDLE            SectionHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  PLARGE_INTEGER     MaximumSize,
  ULONG              SectionPageProtection,
  ULONG              AllocationAttributes,
  HANDLE             FileHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 4A 00 00 00      mov eax, 0x4A
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Creates a `_SECTION` object — the kernel primitive behind every file mapping, every loaded image, and every shared memory region in Windows. SSN `0x4A` has been stable across all Win10/11 builds. `SEC_IMAGE` is the most powerful flag: the kernel parses the FileHandle as a PE (validates headers, applies relocations, sets up subsections per `IMAGE_SECTION_HEADER`) and the resulting view *is* a loaded module from the kernel's perspective — it will appear in `PsLoadedModuleList`-equivalent process structures and produce `Image Load` events. Anonymous (`FileHandle = NULL`) sections backed by the pagefile are simply shared RAM.

Common malware usage

The setup step for every section-based injection technique. Anonymous + `PAGE_EXECUTE_READWRITE` sections feed Process Doppelgänging, Transacted Hollowing, Atom Bombing, and the original `MapViewOfSection` injection. `SEC_IMAGE` sections opened from a clean signed DLL feed module-stomping loaders and `KnownDlls` poisoning. Process Ghosting (created by Gabriel Landau) creates a delete-pending file, builds a `SEC_IMAGE` section over it, then deletes the file before the section is unmapped — leaving an executable image in memory with no on-disk artifact for AV to scan.

Detection opportunities

`NtCreateSection` itself is too common (every `LoadLibrary` and `CreateFileMapping` hits it) to alert on directly. The signals come downstream: ETW Threat Intelligence emits events when a section is mapped executable into a remote process; PE-Sieve and Moneta flag `MappedImage` regions whose backing file has been deleted or replaced; minifilter drivers observe `IRP_MJ_CREATE` with `FILE_DELETE_ON_CLOSE` followed by a section creation as a Process-Ghosting pattern. Sections created with `SEC_IMAGE` over non-Microsoft files in PPL targets are extremely suspicious. Note also that `SEC_NO_CHANGE` + `SEC_IMAGE` is sometimes used to make a region resist `NtProtectVirtualMemory` modifications post-mapping.

Direct syscall examples

; Direct syscall stub for NtCreateSection (SSN 0x4A, stable across all Win10/11)
NtCreateSection PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 4Ah          ; SSN
    syscall
    ret
NtCreateSection ENDP

// Pagefile-backed RWX section, used as the carrier for cross-process shellcode.
HANDLE        hSection = NULL;
LARGE_INTEGER size     = { .QuadPart = 0x10000 };
NTSTATUS st = NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, &size,
                              PAGE_EXECUTE_READWRITE, SEC_COMMIT, NULL);
if (!NT_SUCCESS(st)) return st;
// hSection can now be mapped RW locally and RX remotely (see NtMapViewOfSection).

// Resolve SSN at runtime so the indirect-syscall trampoline doesn't need a build switch.
typedef NTSTATUS (NTAPI *pNtCreateSection)(PHANDLE, ACCESS_MASK,
                                           POBJECT_ATTRIBUTES, PLARGE_INTEGER,
                                           ULONG, ULONG, HANDLE);

DWORD ssn = GetSyscallNumber(GetProcAddress(GetModuleHandleA("ntdll.dll"),
                                            "NtCreateSection"));
set_ssn(ssn);
indirect_syscall_invoke(/* &hSection, ... */);

MITRE ATT&CK mappings

• T1055Process Injection
• T1055.012Process Hollowing
• T1055.013Process Doppelgänging
• T1620Reflective Code Loading