handle.exe

handle.exe -a <pid>

Lists the handles opened by a process, revealing which files, registry keys, and processes (such as lsass) it has access to.

Run it when you want to know what a suspicious process is touching: handle.exe lists the open handles — files, registry keys, processes, threads — of a specific process (-a <pid>). In hunting, the classic use is to check if a process has a handle on lsass.exe (the prerequisite for credential dumping) or on files it shouldn't. It also serves to see which process keeps a file open (the 'who's locking this file?' of IR). It's the context tool: it turns suspicion of a process into evidence of its accesses.

Don't use it as detection per se: an open handle is a state, not an event — a legitimate process (AV, monitoring) also has handles on lsass. Interpretation needs context: which process, why, with what permissions. And watch out for permissions: listing handles of processes from another user or from SYSTEM requires admin; without privileges, the output is partial. On hosts with PPL, handles of protected processes are not visible. For temporal detection of lsass access, Sysmon Event 10 is the tool; handle.exe is the snapshot of the moment.