NtOpenKey

Prototype

NTSTATUS NtOpenKey(
  PHANDLE            KeyHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 12 00 00 00      mov eax, 0x12
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The minimal-arity registry open — three arguments, SSN `0x12` since the dawn of NT. The NT registry namespace lives under `\Registry`, with `\Registry\Machine` mapping to HKLM and `\Registry\User\<SID>` to per-user hives; advapi32's `RegOpenKeyEx` rewrites `HKEY_*` predefined handles to these paths before calling NtOpenKey. There is no `OpenOptions` parameter — for that you need `NtOpenKeyEx`. Callers who need to read SAM/SECURITY must first impersonate SYSTEM (`NtOpenProcessToken` on lsass + `NtDuplicateToken` + `SetThreadToken`) because the hive ACL excludes Administrators by default.

Common malware usage

Gateway to **registry credential dumping**. The canonical chains are: (a) **T1003.002 SAM hive** — open `\Registry\Machine\SAM\SAM\Domains\Account\Users\Names\<user>` to enumerate users, then walk `\...\Users\<RID>\V` for the encrypted password hash, decrypting with the BootKey assembled from four `\Registry\Machine\System\CurrentControlSet\Control\Lsa\{JD,Skew1,GBG,Data}` `Class` attributes; (b) **T1003.004 LSA secrets** — open `\Registry\Machine\SECURITY\Policy\Secrets\*\CurrVal` for cached service-account passwords and DPAPI domain backup keys; (c) **persistence enumeration** — open Run keys, IFEO, AppInit_DLLs, Winlogon Notify, services hive. Mimikatz' `lsadump::sam` and `lsadump::secrets` execute exactly this path, as do secretsdump.py from Impacket and `reg.exe save HKLM\SAM <file>` followed by offline parsing.

Detection opportunities

Microsoft-Windows-Kernel-Registry ETW (`{70EB4F03-C1DE-4F73-A051-33D13D5413BD}`) emits an event per registry open with full path, requesting PID, and access mask. Sysmon Event ID 12 (RegistryEvent, CreateKey/SetKey) and Event ID 13 (SetValue) cover writes; the **read side requires explicit Sysmon RegistryEvent type=CreateKey filtering on `HKLM\SAM`, `HKLM\SECURITY`, `HKLM\Security\Policy\Secrets`** — these are the high-fidelity dump indicators. EDRs hook `NtOpenKey`/`NtOpenKeyEx` in the kernel via `CmRegisterCallbackEx` (RegNtPreOpenKeyEx / RegNtPostOpenKey notifications). Defender's ASR rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" indirectly raises the cost of the LSA-token-theft prelude. Hunt for any non-LSASS/non-svchost process opening `\Registry\Machine\SAM` or `\Registry\Machine\SECURITY`.

Direct syscall examples

UNICODE_STRING name;
RtlInitUnicodeString(&name,
    L"\\Registry\\Machine\\Software\\Microsoft\\Windows\\CurrentVersion\\Run");

OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

HANDLE hKey = NULL;
NTSTATUS s = NtOpenKey(&hKey, KEY_QUERY_VALUE | KEY_ENUMERATE_SUB_KEYS, &oa);

NtOpenKey PROC
    mov  r10, rcx
    mov  eax, 12h
    syscall
    ret
NtOpenKey ENDP

use ntapi::ntregapi::NtOpenKey;
use ntapi::ntrtl::RtlInitUnicodeString;
use winapi::shared::ntdef::{HANDLE, OBJECT_ATTRIBUTES, OBJ_CASE_INSENSITIVE, UNICODE_STRING};

pub unsafe fn open_key(path: *const u16, access: u32) -> Option<HANDLE> {
    let mut us: UNICODE_STRING = core::mem::zeroed();
    RtlInitUnicodeString(&mut us, path);
    let mut oa = OBJECT_ATTRIBUTES {
        Length: core::mem::size_of::<OBJECT_ATTRIBUTES>() as u32,
        RootDirectory: core::ptr::null_mut(),
        ObjectName: &mut us,
        Attributes: OBJ_CASE_INSENSITIVE,
        SecurityDescriptor: core::ptr::null_mut(),
        SecurityQualityOfService: core::ptr::null_mut(),
    };
    let mut h: HANDLE = core::ptr::null_mut();
    if NtOpenKey(&mut h, access, &mut oa) == 0 { Some(h) } else { None }
}

MITRE ATT&CK mappings

• T1003.002OS Credential Dumping: Security Account Managermitre ↗
• T1003.004OS Credential Dumping: LSA Secretsmitre ↗
• T1012Query Registrymitre ↗
• T1106Native APImitre ↗