volatility3 handles

vol.py -f mem.dmp windows.handles

Lists the handles opened by the processes in the dump, revealing access to lsass, files, and objects that betray credential dumping.

Run it when you want to confirm access to sensitive resources at the time of the dump: handles lists the handles of each process — and the classic finding is an unauthorized process with an open handle to lsass.exe (the prerequisite for credential dumping) or to files it shouldn't touch (the .dmp in Temp). It also reveals access to tokens, registry keys, and kernel objects that attack tools open to operate. It's the evidence of dumping from within the dump: the handle on lsass plus the output file draw the complete operation.

Don't use it as detection per se: legitimate handles (AV, monitoring, the system itself) also open lsass — the finding needs context: which process, with what permissions, why. The handle output is huge on active hosts (thousands of handles per process): filter by type (Process, File) and by target (lsass, .dmp). And note: handles sees the handles at the time of the dump — the one-off access that has already been closed doesn't appear; for the temporal view, use Sysmon Event 10. Filtering by type and suspicious process is mandatory to make the output manageable.