NtEnumerateKey

Prototype

NTSTATUS NtEnumerateKey(
  HANDLE                KeyHandle,
  ULONG                 Index,
  KEY_INFORMATION_CLASS KeyInformationClass,
  PVOID                 KeyInformation,
  ULONG                 Length,
  PULONG                ResultLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 32 00 00 00      mov eax, 0x32
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Index-based enumeration: caller drives a loop from `Index=0` upward until it receives `STATUS_NO_MORE_ENTRIES`. Adding or deleting a subkey during enumeration shifts indices, so robust callers either retry the failing index or snapshot names into a list before processing. SSN `0x32` has been stable since Windows 7. `NtEnumerateKey` returns subkeys only — for values you need `NtEnumerateValueKey` (a sister syscall with the same shape).

Common malware usage

**Persistence discovery (T1518 + T1012 + T1547.x)** — both red and blue use the same primitive, just at different ends of the kill chain. The interesting offensive use is *autorun enumeration before planting*: walk every standard auto-execute key first to find an unused name (collision avoidance), or to discover existing entries the implant can hijack (replace the binary path of an installed but rarely-run scheduled-task launcher rather than create a new entry that would be the only one not seen in baselines). Canonical paths: `\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Run`, `RunOnce`, `Explorer\Shell Folders`, `Image File Execution Options` (whose subkeys are *names of executables* — enumerating them is the way to find IFEO-debugger hijack opportunities), `App Paths`, `\Services` (Type=1 driver services, Type=16 own-process services), `\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify`. Stealers also enumerate `\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles` to discover Wi-Fi profile GUIDs before going after the PSKs through `wlanapi`.

Detection opportunities

Volume of `NtEnumerateKey` is gigantic on a normal host (Group Policy refresh, Defender ASR engine, every Explorer namespace expansion). It's not a useful primary signal. Two derivative signals work: (1) **Enumeration of a sensitive key by a non-baseline process** — alert when a process whose image hash has never previously enumerated `\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` does so; (2) **Enumeration followed by SetValueKey** at the same parent — implants typically enumerate to dodge collisions, then write. Microsoft-Windows-Kernel-Registry ETW carries both events with timestamps tight enough to correlate. EDRs register `CmRegisterCallbackEx` and receive `RegNtPreEnumerateKey` / `RegNtPostEnumerateKey` notifications regardless of user-mode hook state. Hunt query: same PID emits ≥ 20 `NtEnumerateKey` calls under `\Microsoft\Windows\CurrentVersion\Run*` plus one `NtSetValueKey` to a sibling within 2 s.

Direct syscall examples

// hIfeo = handle to \Registry\Machine\Software\Microsoft\
//                  Windows NT\CurrentVersion\Image File Execution Options
for (ULONG i = 0;; ++i) {
    BYTE  buf[0x200];
    ULONG got = 0;
    NTSTATUS s = NtEnumerateKey(
        hIfeo, i,
        KeyBasicInformation,
        buf, sizeof(buf), &got);
    if (s == STATUS_NO_MORE_ENTRIES) break;
    if (!NT_SUCCESS(s)) continue;
    PKEY_BASIC_INFORMATION ki = (PKEY_BASIC_INFORMATION)buf;
    // ki->Name is the image name targetable by IFEO Debugger hijack
}

NtEnumerateKey PROC
    mov  r10, rcx
    mov  eax, 32h
    syscall
    ret
NtEnumerateKey ENDP

use ntapi::ntregapi::{NtEnumerateKey, KEY_BASIC_INFORMATION};
use winapi::shared::ntdef::HANDLE;

pub unsafe fn list_subkeys(h: HANDLE) -> Vec<String> {
    let mut names = Vec::new();
    let mut buf = vec![0u8; 0x400];
    for i in 0u32.. {
        let mut got = 0u32;
        let s = NtEnumerateKey(
            h, i, 0 /* KeyBasicInformation */,
            buf.as_mut_ptr() as *mut _, buf.len() as u32, &mut got);
        if s == 0x8000001A /* STATUS_NO_MORE_ENTRIES */ { break; }
        if s != 0 { continue; }
        let ki = &*(buf.as_ptr() as *const KEY_BASIC_INFORMATION);
        let name = core::slice::from_raw_parts(
            ki.Name.as_ptr(), (ki.NameLength / 2) as usize);
        names.push(String::from_utf16_lossy(name));
    }
    names
}

MITRE ATT&CK mappings

• T1518Software Discoverymitre ↗
• T1012Query Registrymitre ↗
• T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Foldermitre ↗
• T1546.012Image File Execution Options Injectionmitre ↗