NtSetEvent

Prototype

NTSTATUS NtSetEvent(
  HANDLE  EventHandle,
  PLONG   PreviousState
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 0E 00 00 00      mov eax, 0xE
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Transitions the event object to the signaled state via `KeSetEvent` inside ntoskrnl.exe. SSN `0x0E` has been stable across every Win10/11 build. For a `SynchronizationEvent` (auto-reset) exactly one waiting thread is released and the event immediately returns to non-signaled; for a `NotificationEvent` (manual reset) all current and future waiters pass through until `NtClearEvent` / `NtResetEvent` is called. Very cheap — typically a few hundred cycles when no waiter needs to be unblocked.

Common malware usage

The trigger half of the sleep-mask pattern: the timer APC routine in Ekko-style chains calls `NtSetEvent` to wake the implant thread out of its alertable wait at each ROP-chain stage (encrypt → sleep → decrypt → resume). In named-pipe C2 designs the producer signals the event after writing to the pipe so the consumer skips a polling loop. Some loaders also signal a kill-switch event to coordinate clean teardown across modules.

Detection opportunities

`NtSetEvent` on its own is unlogged and ubiquitous. Useful detection is contextual: the *pair* of `NtSetEvent` followed within microseconds by `NtWaitForSingleObject` (alertable) on the same handle, performed in a thread whose code RIP sits in private RWX memory, is a near-pathognomonic fingerprint of in-process sleep masking. ETW Threat Intelligence does not emit a dedicated event for SetEvent, so kernel-level handle-correlation or memory-region inspection at sleep boundaries is the realistic path.

Direct syscall examples

; Direct syscall stub for NtSetEvent (SSN 0x0E, stable across Win10/11)
NtSetEvent PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 0Eh          ; SSN
    syscall
    ret
NtSetEvent ENDP

// APC routine attached to an NtSetTimer; signals the wake-up event for the implant.
VOID NTAPI EkkoTimerApc(PVOID ctx, ULONG lo, ULONG hi) {
    (void)lo; (void)hi;
    HANDLE hEvent = (HANDLE)ctx;
    NtSetEvent(hEvent, NULL);   // wakes the alertable WaitForSingleObject in main thread
}

// Cargo: windows-sys = "0.59" (Win32_System_Threading)
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::System::Threading::SetEvent;

unsafe fn signal(h: HANDLE) -> bool {
    SetEvent(h) != 0
}

MITRE ATT&CK mappings

• T1106Native APImitre ↗
• T1027.011Fileless Storagemitre ↗
• T1029Scheduled Transfermitre ↗