NtTerminateEnclave

Prototype

NTSTATUS NtTerminateEnclave(
  PVOID    BaseAddress,
  BOOLEAN  WaitForThread
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 D1 01 00 00      mov eax, 0x1D1
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtTerminateEnclave` is the **destructor** for the enclave lifecycle. It marks the enclave as terminated, frees the VTL1 backing pages, and unmaps the VTL0 view. When `WaitForThread` is `TRUE`, the kernel waits for every host thread that entered via `NtCallEnclave` to return naturally — this is the clean shutdown used by `DeleteEnclave`. When `FALSE`, the kernel uses an Asynchronous Enclave Exit (AEX) to force in-flight threads out at the next interrupt boundary; this can be observed by the host as a `STATUS_ENCLAVE_NOT_TERMINATED` from a concurrent `NtCallEnclave`. After return, the base address is invalid — any read by the host raises a normal page fault.

Common malware usage

Low offensive interest. The interesting work happens in `NtCallEnclave`; termination is mostly cleanup. One niche use: an attacker who has bootstrapped a transient enclave-hosted payload (e.g. extracted a wrapped secret via a Microsoft-signed enclave bug) will call `NtTerminateEnclave` immediately after to minimise forensic surface — the VTL1 pages and the in-enclave heap are released and zeroed before any sysmon/EDR enumeration can run.

Detection opportunities

Largely a *correlation* signal — a tight `NtCreateEnclave` … `NtTerminateEnclave` window with no persistent host-side enclave references is consistent with one-shot abuse; legitimate trustlets (LsaIso, vmms) keep enclaves alive for the lifetime of the host. The ETW provider `Microsoft-Windows-Kernel-Memory` records both create and terminate, so the pair can be reconstructed even after the fact. Defenders should treat termination on its own as benign and focus on the create-call-terminate burst pattern.

Direct syscall examples

// Tear down a VBS enclave and wait for in-flight threads.
#include <windows.h>

BOOL ShutdownEnclave(PVOID enclaveBase) {
    if (!TerminateEnclave(enclaveBase, TRUE /*WaitForThread*/)) {
        return FALSE;
    }
    return DeleteEnclave(enclaveBase); // releases the host-side reservation
}

; Direct syscall stub for NtTerminateEnclave (SSN 0x1D1 on Win11 24H2 / Server 2025)
NtTerminateEnclave PROC
    mov  r10, rcx          ; BaseAddress
    mov  eax, 1D1h         ; SSN
    syscall
    ret
NtTerminateEnclave ENDP

MITRE ATT&CK mappings

• T1620Reflective Code Loadingmitre ↗
• T1106Native APImitre ↗