NtReleaseWorkerFactoryWorker

Prototype

NTSTATUS NtReleaseWorkerFactoryWorker(
  HANDLE  WorkerFactoryHandle
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 7E 01 00 00      mov eax, 0x17E
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The internal counterpart of `SubmitThreadpoolWork`'s 'wake a worker' step. The user-mode wrapper `TpPostWork` posts a packet to the completion port and then calls NtReleaseWorkerFactoryWorker if it sees no waiting worker — the syscall increments the factory's release counter and, if necessary, asks the kernel to spawn an additional thread up to `ThreadMaximum`. Together with NtWorkerFactoryWorkerReady and NtWaitForWorkViaWorkerFactory it forms the three-call worker lifecycle.

Common malware usage

In a PoolParty 'worker via completion port' variant the attacker posts a forged work item with NtSetIoCompletion and then calls NtReleaseWorkerFactoryWorker to guarantee a worker thread will pick it up promptly — useful when the victim's pool is idle and would otherwise leave the malicious packet queued indefinitely. Calling it cross-process (on a duplicated remote worker factory handle) is rare in legitimate code; it is a useful corroborating signal in conjunction with a cross-process NtCreateWorkerFactory.

Detection opportunities

Intra-process invocations are noisy and not actionable. The actionable signature is cross-process: a Release on a worker factory whose owning process is *not* the caller. Kernel callbacks can identify this by walking the WorkerFactory object's `ProcessId` and comparing it to PsGetCurrentProcessId at the syscall site. There is no documented user-mode telemetry for this syscall.

Direct syscall examples

// PoolParty completion-port variant — after NtSetIoCompletion delivered the
// payload, nudge the factory to guarantee a worker thread services it.
NtSetIoCompletion(hIoCompletion, NULL, NULL, STATUS_SUCCESS, 1);
NtReleaseWorkerFactoryWorker(hWorkerFactory);

NtReleaseWorkerFactoryWorker PROC
    mov  r10, rcx
    mov  eax, 17Eh
    syscall
    ret
NtReleaseWorkerFactoryWorker ENDP

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1106Native APImitre ↗