NtOpenProcessTokenEx

Prototype

NTSTATUS NtOpenProcessTokenEx(
  HANDLE       ProcessHandle,
  ACCESS_MASK  DesiredAccess,
  ULONG        HandleAttributes,
  PHANDLE      TokenHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 30 00 00 00      mov eax, 0x30
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtOpenProcessTokenEx is the canonical primitive that `kernel32!OpenProcessToken` actually invokes — `NtOpenProcessToken` is essentially a wrapper retained for source-compat with NT 3.x. Unlike the legacy form, its SSN has been **rock-stable at `0x30`** from Windows 10 1507 through Windows 11 24H2, which makes it a popular target for hardcoded-SSN loaders and SysWhispers stubs. The extra `HandleAttributes` parameter lets callers request inheritable handles (`OBJ_INHERIT`) — useful for parent-PID-spoofed child processes that need to inherit the token.

Common malware usage

Same role as NtOpenProcessToken in token-theft chains, but preferred by modern loaders because of its stable SSN. Cobalt Strike's `steal_token` BOF and the Sliver `getsystem` module both route through this function. JuicyPotato / RoguePotato / PrintSpoofer first negotiate a SYSTEM token via the RPC coercion trick, then call NtOpenProcessTokenEx against the spawned process to retrieve a duplicable handle, then NtDuplicateToken + CreateProcessWithTokenW to spawn SYSTEM-context cmd.exe. The Make-Me-Admin UAC bypass family uses it to clone the medium-IL token's elevated split sibling.

Detection opportunities

Identical detection surface to NtOpenProcessToken: 4672 (Special Privileges Assigned, SeDebugPrivilege), 4663 (object access on Token), 4673 (Sensitive Privilege Use). For LSASS specifically, RunAsPPL forces the call to fail with STATUS_ACCESS_DENIED unless the caller is also PPL — a high-signal failure event. ETW `Microsoft-Windows-Kernel-Audit-API-Calls` emits `PsOpenProcessToken` regardless of which Nt variant was called. EDRs commonly hook this in ntdll; direct syscalls bypass that but the kernel-side object-access audit remains.

Direct syscall examples

; SSN 0x30 stable across Win10 1507 -> Win11 24H2.
NtOpenProcessTokenEx PROC
    mov  r10, rcx          ; ProcessHandle
    mov  eax, 30h          ; SSN
    syscall
    ret
NtOpenProcessTokenEx ENDP

// Locate the elevated split-token sibling of the current medium-IL process
// and ask for TOKEN_DUPLICATE so we can spawn a high-IL process with it.
HANDLE hElev = NULL, hTok = NULL;
// hElev = handle to a high-IL svchost / consent.exe we previously opened
NTSTATUS s = NtOpenProcessTokenEx(
    hElev,
    TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY,
    0,                       // HandleAttributes
    &hTok);
if (NT_SUCCESS(s)) {
    // Next: NtDuplicateToken(... TokenPrimary ...) -> CreateProcessWithTokenW
}

use std::arch::asm;
use windows_sys::Win32::Foundation::HANDLE;

#[unsafe(naked)]
pub unsafe extern "system" fn nt_open_process_token_ex(
    _process: HANDLE,
    _desired: u32,
    _handle_attrs: u32,
    _token_out: *mut HANDLE,
) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x30",
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1134Access Token Manipulation
• T1134.001Token Impersonation/Theft
• T1134.002Create Process with Token
• T1548.002Bypass User Account Control