NtPrivilegedServiceAuditAlarm

Prototype

NTSTATUS NtPrivilegedServiceAuditAlarm(
  PUNICODE_STRING SubsystemName,
  PUNICODE_STRING ServiceName,
  HANDLE          ClientToken,
  PPRIVILEGE_SET  Privileges,
  BOOLEAN         AccessGranted
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 44 01 00 00      mov eax, 0x144
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Sibling of NtPrivilegeObjectAuditAlarm — same shape, but for service-level (no per-object handle) privileged operations. Generates Security event 4673 ("A privileged service was called"). Canonical caller pattern: a service-mode component (e.g. the Service Control Manager loading a kernel driver via SeLoadDriverPrivilege, or the Plug and Play subsystem invoking SeUndockPrivilege) wants the action recorded under its own service identity. The 4673 event includes the service name supplied here, the privileges that were exercised, and the client token's user SID.

Common malware usage

Effectively none in commodity malware. The very purpose of the syscall is to leave a paper trail, which is the inverse of the malware operator's goal. The handful of in-the-wild observations are MS-signed components doing their normal job. Tools like Mimikatz that wield SeDebugPrivilege never call this syscall — they exercise the privilege silently because the Object Manager does not auto-audit privilege use.

Detection opportunities

Event 4673 volume on a clean workstation is dominated by a small set of legitimate operations (driver loads, scheduled-task runs as SYSTEM, WMI provider startups). Defenders should baseline 4673 by (ServiceName, PrivilegeList, ClientUserSid) and alert on novel tuples. Note: the *absence* of 4673 surrounding a SeLoadDriverPrivilege use (verifiable via service-control-manager Event 7045) is far more interesting than its presence — it signals either a non-SCM driver load (T1547.006) or audit-log tampering (T1562.002). Defender for Endpoint surfaces equivalent telemetry via the DeviceProcessEvents and DeviceEvents tables.

Direct syscall examples

; Direct syscall stub for NtPrivilegedServiceAuditAlarm (SSN 0x144, Win11 24H2)
NtPrivilegedServiceAuditAlarm PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 144h         ; SSN
    syscall
    ret
NtPrivilegedServiceAuditAlarm ENDP

// A backup component holding SeBackupPrivilege wants to explicitly record
// a 4673 every time it begins a privileged enumeration pass.

LUID seBackupLuid;
LookupPrivilegeValueW(NULL, SE_BACKUP_NAME, &seBackupLuid);

struct {
    PRIVILEGE_SET ps;
} pset = {
    .ps = { .PrivilegeCount = 1, .Control = PRIVILEGE_SET_ALL_NECESSARY,
            .Privilege = {{ .Luid = seBackupLuid, .Attributes = SE_PRIVILEGE_USED_FOR_ACCESS }} }
};

UNICODE_STRING sub = RTL_CONSTANT_STRING(L"Security");
UNICODE_STRING svc = RTL_CONSTANT_STRING(L"ContosoBackupService");

NTSTATUS s = NtPrivilegedServiceAuditAlarm(
    &sub, &svc,
    hClientToken,
    &pset.ps,
    TRUE);   // success

// Resulting Security event 4673 records:
//   Subject  : NT AUTHORITY\SYSTEM (the service)
//   Service  : ContosoBackupService
//   Privilege: SeBackupPrivilege

use windows_sys::Win32::Security::Authorization::PrivilegedServiceAuditAlarmW;
use windows_sys::Win32::Security::*;

unsafe {
    let ok = PrivilegedServiceAuditAlarmW(
        windows_sys::w!("Security"),
        windows_sys::w!("ContosoBackupService"),
        client_token,
        &priv_set as *const _ as *mut _,
        1, // access_granted
    );
    // ok != 0 -> Security 4673 emitted (subject to "Audit Privilege Use" policy).
}

MITRE ATT&CK mappings

• T1562.002Impair Defenses: Disable Windows Event Loggingmitre ↗
• T1547.006Boot or Logon Autostart Execution: Kernel Modules and Extensionsmitre ↗