NtWaitForMultipleObjects

Prototype

NTSTATUS NtWaitForMultipleObjects(
  ULONG          Count,
  PHANDLE        Handles,
  WAIT_TYPE      WaitType,
  BOOLEAN        Alertable,
  PLARGE_INTEGER Timeout
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 5B 00 00 00      mov eax, 0x5B
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Dispatches through `KeWaitForMultipleObjects` inside ntoskrnl.exe. SSN `0x5B` is stable across every Win10/11 build. With `WaitAny`, the return value `STATUS_WAIT_0..STATUS_WAIT_63` identifies which handle signaled; with `WaitAll`, the kernel must atomically check every object's state, which is why `WaitAll` is comparatively expensive and why `MAXIMUM_WAIT_OBJECTS` is capped at 64 — the dispatcher tracks waiters via a fixed-size block. Like `NtWaitForSingleObject`, the `Alertable` flag opens the thread to user APC delivery (returning `STATUS_USER_APC`).

Common malware usage

Used by implants that maintain multiple simultaneous wake-up sources — typically *(timer event)* + *(kill-switch event)* + *(network-ready event)* — so the beacon can react to either elapsed time or a control-channel push. Sleep-mask variants (Cronos, Zilean) wait on the encryption-stage event plus a cancellation event so the C2 can interrupt a sleep cycle mid-flight. Some droppers wait on multiple thread handles to wait for parallel decryption stages to finish (WaitAll). Less commonly, alertable WaitAny on hand-crafted handle arrays serves as a more flexible APC reception point than single-object waits.

Detection opportunities

Same caveats as `NtWaitForSingleObject`: too common to alert on outright. Useful signals: alertable `WaitAny` over a handle set that includes a private named event held by a process whose code resides in unbacked memory; or a thread routinely waiting on >1 handle with one of them being a kernel transport-layer object (\Device\Afd, named pipe, named event) plus a synthesized timer event. Correlate kernel-mode handle table contents against module-backed thread RIPs at sleep entry.

Direct syscall examples

; Direct syscall stub for NtWaitForMultipleObjects (SSN 0x5B, stable across Win10/11)
NtWaitForMultipleObjects PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 5Bh          ; SSN
    syscall
    ret
NtWaitForMultipleObjects ENDP

// Beacon wakes on either the sleep-timer event or an out-of-band cancel.
HANDLE waits[2] = { hSleepEvent, hCancelEvent };
NTSTATUS st = NtWaitForMultipleObjects(2, waits, WaitAny, TRUE, NULL);
if (st == STATUS_WAIT_0)       { /* normal beacon tick */ }
else if (st == STATUS_WAIT_1)  { /* operator told us to shut down */ }
else if (st == STATUS_USER_APC){ /* APC fired mid-wait */ }

// Spin up N threads to decrypt stage payload, then synchronize before execution.
HANDLE workers[4];
for (int i = 0; i < 4; i++)
    workers[i] = create_decrypt_worker(stage_slice(i));
NtWaitForMultipleObjects(4, workers, WaitAll, FALSE, NULL);
// All slices decrypted; safe to jump into stage.

MITRE ATT&CK mappings

• T1055.004Asynchronous Procedure Callmitre ↗
• T1497Virtualization/Sandbox Evasionmitre ↗
• T1106Native APImitre ↗