NtPulseEvent

Prototype

NTSTATUS NtPulseEvent(
  HANDLE  EventHandle,
  PLONG   PreviousState
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 48 01 00 00      mov eax, 0x148
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtPulseEvent performs a *set-then-reset* on an event object as a single atomic operation. For a manual-reset event it releases *all* threads currently waiting on the event then immediately drops the event back to non-signaled, so any thread that arrives a microsecond later misses the pulse entirely. For a sync (auto-reset) event it releases at most one waiter. Microsoft has long discouraged user-mode use because the window where the event is signaled is racy: PulseEvent is largely a relic from the original NT design. The kernel still implements it (KePulseEvent) and ntoskrnl uses it internally in a few burst-style signaling paths.

Common malware usage

Mostly *legitimate*. Some implants and packers use a pulse-style signal to release a pool of worker threads in a single burst (e.g. orchestrating a thread-pool of decryptors). Because PulseEvent racy semantics mean the wait must already be in place, attackers more commonly choose NtSetEvent followed by NtResetEvent or use a counted semaphore instead. Not a meaningful detection signal on its own.

Detection opportunities

Not a high-signal call. Microsoft-Windows-Kernel-EventTracing and the synchronization-object events do not separately surface PulseEvent. EDR hooks on `ntdll!NtPulseEvent` are uncommon. Investigate only in conjunction with other anomalies — for example a pulse on an event whose name (visible via NtQueryObject) looks suspicious or impersonates a well-known synchronization primitive.

Direct syscall examples

; Direct syscall stub for NtPulseEvent (SSN 0x148 on Win11 24H2)
NtPulseEvent PROC
    mov  r10, rcx          ; EventHandle
    mov  eax, 148h         ; SSN — verify per-build
    syscall
    ret
NtPulseEvent ENDP

// Wake every thread currently parked on hEvent, then immediately drop signaled state.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtPulseEvent)(HANDLE, PLONG);

NTSTATUS PulseBurst(HANDLE hEvent) {
    LONG previous = 0;
    pNtPulseEvent fn = (pNtPulseEvent)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtPulseEvent");
    return fn(hEvent, &previous);
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗