NtOpenEvent

Prototype

NTSTATUS NtOpenEvent(
  PHANDLE            EventHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 40 00 00 00      mov eax, 0x40
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Opens an existing event object by name, returning STATUS_OBJECT_NAME_NOT_FOUND if the name has never been created. SSN `0x40` is stable across every shipped Win10/11 build. The lookup happens inside `ObOpenObjectByName` under the directory specified by `ObjectAttributes->RootDirectory` (typically `\BaseNamedObjects` or a per-session `\Sessions\<n>\BaseNamedObjects`). The returned handle is independent of the creator's lifetime — once both creator and opener close their handles, the kernel object is reaped.

Common malware usage

Cross-process implant coordination: a stager creates a named event then the persistent module opens it to know when to begin operating, or a watchdog opens the event to detect that the main payload is still alive. In named-pipe C2 (Brute Ratel, Sliver pivots), the server side opens the event the client signals when bytes are ready, avoiding busy-wait. Some loaders open a well-known event name as a kill-switch / sandbox probe — if the event exists, the analyst environment is detected (classic WannaCry-style guardrail, generalized).

Detection opportunities

By itself opening an event is high-volume and benign. The strong signal is opening events whose names match suspicious patterns (random GUIDs, family-known strings like `Global\Ekko*`, `Global\BR4*`), or opening an event in a process whose parent chain is not the creator. ETW `Microsoft-Windows-Kernel-Object` `OpenHandle` events expose this. EDRs that resolve `OBJECT_ATTRIBUTES.ObjectName` on every Nt* open call (rather than only Win32 layers) catch direct-syscall variants that bypass `OpenEventW` hooks.

Direct syscall examples

; Direct syscall stub for NtOpenEvent (SSN 0x40, stable across Win10/11)
NtOpenEvent PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 40h          ; SSN
    syscall
    ret
NtOpenEvent ENDP

UNICODE_STRING name;
RtlInitUnicodeString(&name, L"\\BaseNamedObjects\\Global\\BeaconReady");
OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

HANDLE hEvent = NULL;
NTSTATUS st = NtOpenEvent(&hEvent, EVENT_MODIFY_STATE | SYNCHRONIZE, &oa);
if (st == STATUS_OBJECT_NAME_NOT_FOUND) {
    // creator side hasn't started yet
}

// Cargo: windows-sys = "0.59"
use windows_sys::Win32::System::Threading::{OpenEventW, EVENT_MODIFY_STATE};
use windows_sys::core::w;

unsafe fn looks_like_sandbox() -> bool {
    // Many analyst VMs pre-create well-known names; presence reveals instrumentation.
    !OpenEventW(EVENT_MODIFY_STATE, 0, w!("Global\\CuckooEventMutex")).is_null()
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1497Virtualization/Sandbox Evasionmitre ↗
• T1480Execution Guardrailsmitre ↗