NtCreateTimer2

Prototype

NTSTATUS NtCreateTimer2(
  PHANDLE            TimerHandle,
  PVOID              Reserved1,
  PVOID              Reserved2,
  POBJECT_ATTRIBUTES ObjectAttributes,
  ULONG              Attributes,
  ACCESS_MASK        DesiredAccess
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 CC 00 00 00      mov eax, 0xCC
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Introduced in Windows 10 1507 as the kernel backend for the **Threadpool Timer v2** subsystem (`CreateThreadpoolTimer` / `SetThreadpoolTimer`). Unlike the legacy `NtCreateTimer`, Timer2 collapses what used to be several separate flags and follow-up calls into a single creation step: the `Attributes` mask declares up-front whether the timer is manual-reset and whether it requests a *high-resolution* (sub-millisecond) tick from the kernel's high-resolution timer queue. Internally `ExCreateTimer2` allocates an `EX_TIMER` instead of a bare `KTIMER`, gets parented to `PspHostSiloGlobals`, and is driven by the second-generation `KiProcessExpiredTimerList` path. The two `Reserved` pointer slots are vestigial from the original WDDM-era design that exposed a kernel-side completion callback.

Common malware usage

The Timer2 family is the **modern sleep-mask substrate** of choice for evasion researchers who target Windows 10 1809+: it produces *less* telemetry than legacy `NtCreateTimer` + `NtSetTimer` because the `EX_TIMER` object is not surfaced in the same Sysmon/ETW handle-creation paths some EDR vendors monitor. Several **PoolParty** variants (SafeBreach, BlackHat EU 2023) — specifically the worker-factory variants that pivot off thread-pool internals — prefer `NtCreateTimer2` because the resulting `TpTimer` object lives entirely inside private threadpool state, sidestepping naive timer-handle enumeration. The same primitive underpins the Timer2 branch of the **Cronos** and **Zilean** sleep-mask families (2024 forks of Ekko), which use high-resolution mode to shorten the encrypted-RWX window from milliseconds to microseconds.

Detection opportunities

There is no Sysmon event for Timer2 creation. The high-fidelity blue-team angle is ETW `Microsoft-Windows-Kernel-EventTracing` plus `Microsoft-Windows-Threading` (provider `{8a2b7ef8-7d7e-4f1a-a8b8-65b0e9eb...}`) combined with stack-walk of `NtCreateTimer2` callers: legitimate use comes almost exclusively from `ntdll!TppTimerCreate` invoked by `kernel32!CreateThreadpoolTimer` — anything else (especially callers in private RWX memory) is suspect. Mature EDRs detect Ekko-derived sleep masks by snapshotting threadpool `TP_TIMER` lists during periodic scans and flagging timers whose `Callback` pointer lies in unbacked memory, regardless of which `NtCreateTimer*` variant produced them.

Direct syscall examples

; Direct syscall stub for NtCreateTimer2 (SSN 0xCC on Win11 24H2 / Server 2025)
NtCreateTimer2 PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 0CCh         ; SSN — drifts; resolve dynamically for portability
    syscall
    ret
NtCreateTimer2 ENDP

// Single call sets up a high-res manual-reset Timer2 — Ekko-style designs
// previously needed NtCreateTimer + NtSetTimerEx for the same configuration.
#define TIMER_TYPE_MANUAL_RESET     0x1
#define TIMER_TYPE_HIGH_RESOLUTION  0x2

HANDLE hTimer = NULL;
NTSTATUS st = NtCreateTimer2(&hTimer,
                             NULL, NULL,
                             NULL,
                             TIMER_TYPE_MANUAL_RESET | TIMER_TYPE_HIGH_RESOLUTION,
                             TIMER_ALL_ACCESS);
if (!NT_SUCCESS(st)) return st;
// Arm with NtSetTimer2 next, then wait alertably; APC delivers the sleep-mask stage.

// Cargo: windows-sys = "0.59" (Win32_System_Threading)
use windows_sys::Win32::System::Threading::{
    CreateThreadpoolTimer, PTP_TIMER, PTP_CALLBACK_INSTANCE,
};
use std::ptr::null_mut;

unsafe extern "system" fn tick(_inst: PTP_CALLBACK_INSTANCE, _ctx: *mut core::ffi::c_void, _t: PTP_TIMER) {}

// Underlying transition: ntdll!TppTimerCreate -> NtCreateTimer2(HIGH_RESOLUTION).
unsafe fn make() -> PTP_TIMER {
    CreateThreadpoolTimer(Some(tick), null_mut(), null_mut())
}

MITRE ATT&CK mappings

• T1027.011Fileless Storagemitre ↗
• T1055Process Injectionmitre ↗
• T1106Native APImitre ↗