NtSetInformationThread

Prototype

NTSTATUS NtSetInformationThread(
  HANDLE          ThreadHandle,
  THREADINFOCLASS ThreadInformationClass,
  PVOID           ThreadInformation,
  ULONG           ThreadInformationLength
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 0D 00 00 00      mov eax, 0xD
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

The SSN for NtSetInformationThread is `0xD` across every modern Windows build, which makes it a favorite anchor for hand-rolled syscall stubs. The interesting surface is the `THREADINFOCLASS` enum: `ThreadHideFromDebugger = 0x11` causes KiDispatchException to skip notifying any attached debugger of exceptions raised by that thread, effectively rendering breakpoint and single-step events invisible. `ThreadBreakOnTermination = 0x12` flips the EPROCESS BreakOnTermination bit so that thread teardown bug-checks the system — sometimes weaponized as a crude anti-tamper trip-wire. Many other classes (ThreadIdealProcessor, ThreadPriorityBoost) are entirely benign.

Common malware usage

ThreadHideFromDebugger is *the* canonical user-mode anti-debug primitive — invoked on the main thread (and often every worker) at startup to silence usermode debuggers like x64dbg, WinDbg, and IDA's local debugger. Commercial packers (VMProtect, Themida, Enigma) call it; so do most off-the-shelf crypters, document droppers, and Cobalt Strike post-ex tools that want to evade analyst sandboxes. Some malware also abuses ThreadBreakOnTermination so that if an EDR forcibly kills the implant thread, the host blue-screens — a destructive evasion sometimes seen in wipers and aggressive rootkits.

Detection opportunities

On Windows 10 1809+ the kernel emits an ETW Threat Intelligence event (`EtwTiLogSetInformationThread`) whenever ThreadHideFromDebugger is set, which Defender for Endpoint and most modern EDRs consume — this is the highest-fidelity signal available because direct-syscall callers cannot suppress it from user mode. Microsoft-Windows-Threat-Intelligence is a protected ETW provider, so PPL/AntiMalware Light enrollment is required to subscribe. Userland EDR hooks on `ntdll!NtSetInformationThread` are routinely bypassed via direct syscalls, so kernel telemetry is the only reliable layer. Correlate with ThreadInformationClass == 0x11 to keep noise low.

Direct syscall examples

; SSN 0xD on all modern builds. ThreadInformationClass = 0x11 (ThreadHideFromDebugger).
HideCurrentThread PROC
    sub  rsp, 28h
    mov  rcx, -2              ; NtCurrentThread()
    mov  edx, 11h             ; ThreadHideFromDebugger
    xor  r8, r8               ; ThreadInformation = NULL
    xor  r9d, r9d             ; ThreadInformationLength = 0
    mov  r10, rcx
    mov  eax, 0Dh
    syscall
    add  rsp, 28h
    ret
HideCurrentThread ENDP

// Resolves ntdll!NtSetInformationThread and calls it as-is so EDR
// hooks on the prologue still see the call — useful when only the
// ThreadHideFromDebugger event matters and the loader doesn't want
// to look suspicious otherwise.
typedef NTSTATUS(NTAPI* fnNtSetInformationThread)(
    HANDLE, ULONG, PVOID, ULONG);

void HideFromDebugger(void) {
    HMODULE h = GetModuleHandleA("ntdll.dll");
    fnNtSetInformationThread p = (fnNtSetInformationThread)
        GetProcAddress(h, "NtSetInformationThread");
    p((HANDLE)-2, 0x11 /* ThreadHideFromDebugger */, NULL, 0);
}

// Cargo: windows-sys = "0.59"
use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_set_information_thread_stub(
    _thread: isize,
    _class: u32,
    _info: *mut u8,
    _len: u32,
) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0xD",
        "syscall",
        "ret",
        options(noreturn),
    );
}

pub fn hide_from_debugger() -> i32 {
    unsafe { nt_set_information_thread_stub(-2, 0x11, core::ptr::null_mut(), 0) }
}

MITRE ATT&CK mappings

• T1622Debugger Evasion
• T1106Native API
• T1497Virtualization/Sandbox Evasion