LetMeowIn implements this technique within a function named HijackHandle which goes through the following high-level steps to hijack a process’ existing handle to the LSASS process: Leverages NtQuerySystemInformation with SystemHandleInformation to get a list of all open handles and their associated PIDs.

Source: Binary Defense