apmx_correlate_handles
Correlate handle values across API calls to reconstruct attack chains like process injection, mapping handle producers to consumers in APMX captures.
Instructions
Track handle values across API calls to reconstruct operation chains. Identifies handle-producing APIs (OpenProcess, CreateFile, etc.) and traces where those handles are consumed (VirtualAllocEx, WriteProcessMemory, etc.). Reveals attack chains like: OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of handle chains to return | |
| file_path | Yes | Path to .apmx64 or .apmx86 capture file | |
| target_apis | No | Limit to specific APIs (default: common injection/evasion APIs) | |
| process_index | No | Which process to analyze (0 = first/only process) |