NtQueryInformationByName

Prototype

NTSTATUS NtQueryInformationByName(
  POBJECT_ATTRIBUTES       ObjectAttributes,
  PIO_STATUS_BLOCK         IoStatusBlock,
  PVOID                    FileInformation,
  ULONG                    Length,
  FILE_INFORMATION_CLASS   FileInformationClass
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1                  mov r10, rcx
B8 53 01 00 00            mov eax, 0x153
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03                     jne short +3
0F 05                     syscall
C3                        ret
CD 2E                     int 2Eh
C3                        ret

Undocumented notes

Introduced in Windows 10 1709 (officially documented usage starting at RS5/1803), NtQueryInformationByName collapses the legacy `NtCreateFile → NtQueryInformationFile → NtClose` triplet into a single syscall when the caller only needs metadata. Internally the kernel still has to traverse the parent directory's filesystem stack and acquire a transient FILE_OBJECT, but never installs a handle in the caller's handle table — meaning fewer Sysmon Event ID 11/15 noise events and zero handle-table churn. Only a handful of `FILE_INFORMATION_CLASS` values are accepted (FileStatInformation, FileStatBasicInformation, FileStatLxInformation, FileCaseSensitiveInformation, FileStorageReserveIdInformation).

Common malware usage

Used by scanners, environment-keying loaders, and EDR-aware staged-payload droppers to test for the existence of marker files (e.g. proof of a specific build of an EDR on disk, or a victim-fingerprint file) without leaving an open-handle telemetry trail. Because no handle is created, file-system minifilters that key off `IRP_MJ_CREATE` see the open as transient and ephemeral; user-mode hooks on `NtCreateFile`/`NtOpenFile` are bypassed entirely — the syscall path is `NtQueryInformationByName` directly. The signal is weaker than NtCreateFile-based reconnaissance, which is precisely the point. Some commodity scanners (CCleaner-style profilers, but also more recent infostealers) have migrated to this API to reduce open-file noise.

Detection opportunities

Filesystem minifilters still see the transient IRP_MJ_CREATE — Sysmon File events configured with `IncludeTransientHandles=true` (a relatively new option) will surface these. ETW Microsoft-Windows-Kernel-File `Create` events fire with a `TransitionTrace` flag set distinguishing the by-name query from a held-handle open. Hunting on `NtQueryInformationByName` calls targeting `*.exe`, `*.dll`, or specific EDR install paths from a non-system process is a stronger anomaly signal than the syscall itself. Sysmon Event ID 11 (FileCreate) and Event ID 15 (FileCreateStreamHash) will *not* fire — that absence, paired with file-existence-conditioned behaviour, is the detection.

Direct syscall examples

// Probe for the presence of an EDR DLL on disk using the new RS5+ syscall.
#include <windows.h>
#include <winternl.h>

typedef struct _FILE_STAT_BASIC_INFORMATION {
    LARGE_INTEGER FileId;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER AllocationSize;
    LARGE_INTEGER EndOfFile;
    ULONG FileAttributes;
    ULONG ReparseTag;
    ULONG NumberOfLinks;
    ULONG DeviceType;
    ULONG DeviceCharacteristics;
    ULONG Reserved;
    LARGE_INTEGER VolumeSerialNumber;
    FILE_ID_128 FileId128;
} FILE_STAT_BASIC_INFORMATION;

typedef NTSTATUS (NTAPI *PNTQUERYINFORMATIONBYNAME)(
    POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, PVOID, ULONG, ULONG);

BOOL FileExistsQuietly(LPCWSTR ntPath) {
    UNICODE_STRING us;
    RtlInitUnicodeString(&us, ntPath);

    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa, &us, OBJ_CASE_INSENSITIVE, NULL, NULL);

    FILE_STAT_BASIC_INFORMATION info;
    IO_STATUS_BLOCK iosb;

    PNTQUERYINFORMATIONBYNAME f = (PNTQUERYINFORMATIONBYNAME)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtQueryInformationByName");

    return f && f(&oa, &iosb, &info, sizeof(info), 75 /* FileStatBasicInformation */) == 0;
}

NtQueryInformationByName PROC
    mov  r10, rcx
    mov  eax, 153h
    syscall
    ret
NtQueryInformationByName ENDP

MITRE ATT&CK mappings

• T1083File and Directory Discoverymitre ↗
• T1106Native APImitre ↗
• T1518.001Security Software Discoverymitre ↗