Sysmon Event ID 10: Process accessed
Records one process opening another process, with the access rights it asked for.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- Credential access
Why it matters
- Unexpected processes opening lsass.exe with memory-read rights is how credential dumping (for example Mimikatz) shows up.
What to check
Filter TargetImage to lsass.exe and check SourceImage, GrantedAccess and CallTrace.
How to turn it on
Sysmon configuration including ProcessAccess, usually limited to lsass.exe.
MITRE ATT&CK
- T1003.001 LSASS Memory