apmx_correlate_handles
Track handle values across API calls to reconstruct operation chains, revealing attack sequences like OpenProcess to CreateRemoteThread from Windows process captures.
Instructions
Track handle values across API calls to reconstruct operation chains. Identifies handle-producing APIs (OpenProcess, CreateFile, etc.) and traces where those handles are consumed (VirtualAllocEx, WriteProcessMemory, etc.). Reveals attack chains like: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of handle chains to return | |
| file_path | Yes | Path to .apmx64 or .apmx86 capture file | |
| target_apis | No | Limit to specific APIs (default: common injection/evasion APIs) | |
| process_index | No | Which process to analyze (0 = first/only process) |