NtShutdownWorkerFactory

Prototype

NTSTATUS NtShutdownWorkerFactory(
  HANDLE  WorkerFactoryHandle,
  LONG   *PendingWorkerCount
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 C7 01 00 00      mov eax, 0x1C7
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Setting the shutdown flag on a worker factory prevents the kernel from spawning further worker threads but lets existing ones drain to their natural exit. The returned `PendingWorkerCount` lets the caller poll for full quiescence before closing the underlying I/O completion port. `ntdll!TppWorkerFactoryShutdown` and `RtlpThreadpoolWorkerFactoryShutdown` both call this; user code rarely does so directly outside of CRT teardown or LdrShutdownProcess.

Common malware usage

After a PoolParty execution succeeds and the shellcode has done its work, the implant often calls NtShutdownWorkerFactory to gracefully tear down the foreign threadpool — leaving fewer artefacts than a hard `NtTerminateThread`. The same syscall can be weaponised defensively-by-the-attacker too: an attacker with `WORKER_FACTORY_SHUTDOWN` rights on a victim's threadpool can paralyse the victim's async pipelines (HTTP server worker pool, .NET ThreadPool, RPC dispatchers) without crashing the process — a stealthy denial-of-service. Public PoolParty PoCs include shutdown as the cleanup step.

Detection opportunities

Standalone NtShutdownWorkerFactory calls are noisy in normal teardown — every process exit issues some — so cross-process invocation is the meaningful signal. Pair it with the upstream NtCreateWorkerFactory event: a process that creates a worker factory in another process and shortly thereafter shuts it down is highly suspect. The kernel object manager records open handles to the WorkerFactory; ObRegisterCallbacks can intercept handle duplications across process boundaries.

Direct syscall examples

// Called by the loader after the shellcode signals 'done'.
LONG pending = 0;
NTSTATUS s = NtShutdownWorkerFactory(hWorkerFactory, &pending);
while (NT_SUCCESS(s) && pending > 0) {
    // Workers still draining — sleep, then re-query.
    Sleep(50);
    NtQueryInformationWorkerFactory(hWorkerFactory,
        WorkerFactoryBasicInformation,
        &basic, sizeof(basic), NULL);
    pending = basic.TotalWorkerCount;
}
NtClose(hWorkerFactory);
NtClose(hIoCompletion);

NtShutdownWorkerFactory PROC
    mov  r10, rcx
    mov  eax, 1C7h     ; Win11 24H2 / Server 2025
    syscall
    ret
NtShutdownWorkerFactory ENDP

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1106Native APImitre ↗