NtQuerySecurityObject

Prototype

NTSTATUS NtQuerySecurityObject(
  HANDLE               Handle,
  SECURITY_INFORMATION SecurityInformation,
  PSECURITY_DESCRIPTOR SecurityDescriptor,
  ULONG                Length,
  PULONG               LengthNeeded
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 68 01 00 00      mov eax, 0x168
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Universal accessor for security descriptors across object types. Reading the SACL requires SE_SECURITY_NAME (ACCESS_SYSTEM_SECURITY) — most callers therefore omit SACL_SECURITY_INFORMATION. Returns STATUS_BUFFER_TOO_SMALL with the required size in LengthNeeded; the standard pattern is a probe call with Length=0 followed by an allocation. Win32 wrappers GetSecurityInfo / GetKernelObjectSecurity / GetUserObjectSecurity all eventually land here.

Common malware usage

Reconnaissance step that almost always precedes a SetSecurityObject — the implant reads the current SDDL of a target (service registry key, scheduled task file, EDR install directory) to know what to merge or strip. Also used by privilege-discovery tooling like PowerSploit's Get-DomainObjectAcl-equivalent code to spot weak ACLs (e.g. a service registry key writable by Authenticated Users) that can be abused without touching anything. In credential-theft chains, NtQuerySecurityObject against an LSASS handle confirms which privileges and access bits the operator actually obtained.

Detection opportunities

By itself extremely high volume — every Open dialog, every file Properties window, every UAC prompt calls this. The detection bar is *context*: NtQuerySecurityObject on `HKLM\SYSTEM\CurrentControlSet\Services\<EDR>` or on `lsass.exe` from a non-trusted process is interesting. Object-Access auditing (Event 4663 with `Accesses: Read SD`) covers most cases but is noisy until tuned. EDRs that mediate file/process opens see the READ_CONTROL on the handle that NtQuerySecurityObject depends on. Bluespawn-style detection focuses on the *paired* SetSecurityObject that follows.

Direct syscall examples

// Read the DACL of a service registry key in two calls.
ULONG needed = 0;
NTSTATUS st = NtQuerySecurityObject(hSvcKey, DACL_SECURITY_INFORMATION,
                                    NULL, 0, &needed);
if (st == STATUS_BUFFER_TOO_SMALL) {
    PVOID sd = RtlAllocateHeap(RtlProcessHeap(), 0, needed);
    st = NtQuerySecurityObject(hSvcKey, DACL_SECURITY_INFORMATION,
                               sd, needed, &needed);
    // Now walk the DACL and decide what to weaken.
}

NtQuerySecurityObject PROC
    mov  r10, rcx
    mov  eax, 168h
    syscall
    ret
NtQuerySecurityObject ENDP

// Cargo: ntapi = "0.4", windows-sys = "0.59"
let mut needed: u32 = 0;
let st = unsafe {
    NtQuerySecurityObject(h_dir,
        DACL_SECURITY_INFORMATION | OWNER_SECURITY_INFORMATION,
        null_mut(), 0, &mut needed)
};
assert_eq!(st, STATUS_BUFFER_TOO_SMALL as i32);
let mut buf = vec![0u8; needed as usize];
unsafe {
    NtQuerySecurityObject(h_dir,
        DACL_SECURITY_INFORMATION | OWNER_SECURITY_INFORMATION,
        buf.as_mut_ptr() as _, buf.len() as u32, &mut needed);
}

MITRE ATT&CK mappings

• T1069Permission Groups Discoverymitre ↗
• T1087Account Discoverymitre ↗
• T1106Native APImitre ↗