NtQueryInformationToken

Prototype

NTSTATUS NtQueryInformationToken(
  HANDLE                  TokenHandle,
  TOKEN_INFORMATION_CLASS TokenInformationClass,
  PVOID                   TokenInformation,
  ULONG                   TokenInformationLength,
  PULONG                  ReturnLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 21 00 00 00      mov eax, 0x21
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtQueryInformationToken is the read-side counterpart to NtSetInformationToken and what `advapi32!GetTokenInformation` wraps. The SSN has been **stable at `0x21`** from Windows 10 1507 through Windows 11 24H2. The most operationally useful classes for offensive work are `TokenUser` (the user SID), `TokenGroups` (group SIDs — reveals Administrators, BUILTIN\Backup Operators, etc.), `TokenPrivileges`, `TokenStatistics` (contains the LUID needed for `NtFilterToken`-style impersonation linkage), `TokenIntegrityLevel`, `TokenElevation`, and `TokenLinkedToken` (the elevated split-token sibling used by Make-Me-Admin UAC bypasses).

Common malware usage

Implants use NtQueryInformationToken for situational awareness right after landing: are we elevated? are we SYSTEM? what groups do we belong to? what privileges are enabled? `TokenLinkedToken` is the linchpin of the silent Make-Me-Admin UAC bypass family (`AppInfo!RAiLaunchAdminProcess` shortcut chains): a medium-IL admin process queries its own linked token to obtain a high-IL token handle, then duplicates and impersonates without prompting consent.exe. Mimikatz' `token::list` simply enumerates handles and calls NtQueryInformationToken with `TokenUser` and `TokenStatistics`.

Detection opportunities

NtQueryInformationToken is extraordinarily noisy in benign software — every COM call, every shell extension, every `whoami`-style operation hits it. It is not a useful detection on its own. What *is* useful: correlating queries of `TokenLinkedToken` from medium-IL processes followed shortly by NtDuplicateToken + CreateProcessWithTokenW (Make-Me-Admin pattern), or queries of `TokenStatistics` immediately followed by `NtSetInformationThread(ThreadImpersonationToken)` (impersonation chain). The ETW provider `Microsoft-Windows-Kernel-Audit-API-Calls` does not specifically log token queries; defenders typically rely on the EDR's user-mode hook on `ntdll!NtQueryInformationToken`.

Direct syscall examples

NtQueryInformationToken PROC
    mov  r10, rcx          ; TokenHandle
    mov  eax, 21h          ; SSN stable across all builds
    syscall
    ret
NtQueryInformationToken ENDP

// Check if the current token belongs to NT AUTHORITY\SYSTEM.
BOOL IsRunningAsSystem(HANDLE hToken) {
    BYTE buf[256];
    ULONG ret = 0;
    if (!NT_SUCCESS(NtQueryInformationToken(
            hToken, TokenUser, buf, sizeof(buf), &ret)))
        return FALSE;

    PTOKEN_USER tu = (PTOKEN_USER)buf;
    PSID systemSid = NULL;
    SID_IDENTIFIER_AUTHORITY ntAuth = SECURITY_NT_AUTHORITY;
    AllocateAndInitializeSid(&ntAuth, 1, SECURITY_LOCAL_SYSTEM_RID,
                             0,0,0,0,0,0,0, &systemSid);
    BOOL eq = EqualSid(tu->User.Sid, systemSid);
    FreeSid(systemSid);
    return eq;
}

// Locate the elevated split-token sibling of an elevated-but-filtered process.
// If present, a high-IL token handle can be duplicated without UAC prompt.
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::Security::{
    TOKEN_LINKED_TOKEN, TOKEN_INFORMATION_CLASS,
};

const TOKEN_LINKED_TOKEN_CLASS: TOKEN_INFORMATION_CLASS = 19; // TokenLinkedToken

extern "system" {
    fn NtQueryInformationToken(
        h: HANDLE, class: TOKEN_INFORMATION_CLASS,
        buf: *mut u8, len: u32, ret: *mut u32) -> i32;
}

pub unsafe fn try_get_linked_token(h: HANDLE) -> Option<HANDLE> {
    let mut lt = TOKEN_LINKED_TOKEN { LinkedToken: 0 };
    let mut ret = 0u32;
    let s = NtQueryInformationToken(
        h, TOKEN_LINKED_TOKEN_CLASS,
        &mut lt as *mut _ as *mut u8,
        std::mem::size_of::<TOKEN_LINKED_TOKEN>() as u32,
        &mut ret);
    if s == 0 && lt.LinkedToken != 0 { Some(lt.LinkedToken) } else { None }
}

MITRE ATT&CK mappings

• T1134Access Token Manipulation
• T1033System Owner/User Discovery
• T1548.002Bypass User Account Control
• T1106Native API