NtDeleteDriverEntry

Prototype

NTSTATUS NtDeleteDriverEntry(
  ULONG Id
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 DA 00 00 00      mov eax, 0xDA
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Single-argument syscall. On UEFI the kernel issues an `EFI_SET_VARIABLE` with `DataSize = 0` against the matching `Driver####` NVRAM variable, the firmware-defined deletion semantic. SeSystemEnvironmentPrivilege is required. The corresponding DriverOrder slot must be cleaned up separately via NtSetSystemEnvironmentValueEx or it will continue to reference an empty variable.

Common malware usage

Two complementary abuses. (1) **Cleanup**: after a DXE-based payload has flashed its second-stage to SPI flash or a hidden NVRAM blob, the attacker deletes the visible bootstrap DRIVER_ENTRY so that defender-side `bcdedit /enum FIRMWARE` and CHIPSEC scans no longer show an anomalous entry — the implant lives entirely in firmware. (2) **Sabotage**: ransomware can delete OEM recovery/diagnostic driver entries (vendor BIOS update DXE drivers) to brick the firmware-update path the victim would otherwise use to restore the platform, complementing MBR/GPT wipers.

Detection opportunities

ETW Microsoft-Windows-Kernel-Boot logs the deletion. The high-value heuristic is correlation across a fleet: if a single host suddenly has *fewer* DRIVER_ENTRYs than its hardware-identical peers in your CMDB, that delta is suspect. CHIPSEC's `tools.uefi.uefivar_fuzz`/`platform.smm_dma` and Eclypsium's baseline can flag the absence of expected OEM driver entries. Audit 4673 (SeSystemEnvironmentPrivilege) on the host where the deletion occurred to pin down the parent process.

Direct syscall examples

NtDeleteDriverEntry PROC
    mov  r10, rcx          ; ULONG Id
    mov  eax, 0DAh         ; Win11 24H2
    syscall
    ret
NtDeleteDriverEntry ENDP

// Conceptual: after the DXE driver has executed once and written its persistent
// payload into SPI/NVRAM, remove the visible bootstrap entry.
extern NTSTATUS NTAPI NtDeleteDriverEntry(ULONG);

NTSTATUS hide_tracks(ULONG bootstrap_id) {
    NTSTATUS s = NtDeleteDriverEntry(bootstrap_id);
    // Caller must also rewrite DriverOrder via NtSetSystemEnvironmentValueEx.
    return s;
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_delete_driver_entry(_id: u32) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0xDA",   // Win11 24H2
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1542.001Pre-OS Boot: System Firmwaremitre ↗
• T1014Rootkitmitre ↗
• T1490Inhibit System Recoverymitre ↗