NtTerminateThread

Prototype

NTSTATUS NtTerminateThread(
  HANDLE   ThreadHandle,
  NTSTATUS ExitStatus
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 53 00 00 00      mov eax, 0x53
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Pleasantly stable SSN — 0x53 from Windows 10 1507 through Windows 11 24H2 — because NtTerminateThread sits early in the alphabetical SSDT and few preceding routines have been added. The kernel implementation funnels through PsTerminateThreadByPointer, decrements the rundown reference, signals waiters, and ultimately reaps the thread object. When called with a NULL handle the kernel substitutes the current thread (ZwCurrentThread / (HANDLE)-2 semantics).

Common malware usage

Three classic patterns. (1) Race-stopping: terminate an EDR scan thread mid-scan so a write to disk completes before re-scan. (2) Stub cleanup: after hijacking a thread (NtSetContextThread to shellcode), the payload eventually calls NtTerminateThread(NULL, 0) to discard the hijacked thread without invoking the now-corrupted return chain. (3) Suicide on tamper detection: many crypters call NtTerminateThread on themselves the moment they detect an attached debugger to deny the analyst a live process. Often paired with NtTerminateProcess for a full self-wipe.

Detection opportunities

Self-termination is invisible noise. Cross-process termination of *another* process's thread is rare and high-signal — most legitimate code calls NtTerminateProcess instead. Capture via Microsoft-Windows-Threat-Intelligence ETW (EtwTiLogTerminateThread on some builds) or a PsSetCreateThreadNotifyRoutine watching for unusual TerminationStatus values from non-system PIDs. On modern Windows the most useful signal is *correlation*: cross-process NtOpenThread followed within milliseconds by NtTerminateThread targeting a security product PID.

Direct syscall examples

; SSN 0x53 — stable Win10 1507 .. Win11 24H2.
NtTerminateThread PROC
    mov  r10, rcx
    mov  eax, 53h
    syscall
    ret
NtTerminateThread ENDP

// At the tail of injected shellcode: cleanly exit the hijacked thread so the
// stack/return-address damage from the hijack never executes.
static VOID PayloadEpilogue(VOID) {
    // ... shellcode work ...
    typedef NTSTATUS (NTAPI *pNtTerminateThread)(HANDLE, NTSTATUS);
    pNtTerminateThread NtTerm = (pNtTerminateThread)
        GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtTerminateThread");
    NtTerm(NULL, 0);   // NULL = current thread
}

use std::arch::asm;

#[inline(never)]
unsafe fn nt_terminate_current_thread() -> ! {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x53",
        "syscall",
        in("rcx") 0usize,    // ThreadHandle = NULL -> current
        in("rdx") 0usize,    // ExitStatus  = 0
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1562.001Impair Defenses: Disable or Modify Toolsmitre ↗
• T1055.003Thread Execution Hijackingmitre ↗
• T1106Native APImitre ↗