10 Sysmon log · ProcessAccess high severity medium volume

Sysmon Event ID 10 — Process accessed

A process opened another process's memory. SourceImage, TargetImage, GrantedAccess (access mask) are key.

Why event 10 matters

LSASS memory dumping: SourceImage accesses TargetImage=lsass.exe with GrantedAccess 0x1010 or 0x1410 (read process memory). Tools: Mimikatz, ProcDump (procdump -ma lsass.exe), Task Manager memory dump, comsvcs.dll MiniDump. GrantedAccess mask reveals intent: 0x1010=PROCESS_VM_READ+PROCESS_QUERY_INFORMATION (dumping), 0x40=PROCESS_DUP_HANDLE.

How to detect it

Alert: TargetImage=lsass.exe with GrantedAccess 0x1010, 0x1410, 0x1438, 0x143a, 0x1F1FFF, 0x1FFFFF. Filter: known AV and EDR processes that legitimately read LSASS. This is the highest-fidelity LSASS dump detection available from Sysmon.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
SourceImageTargetImageGrantedAccessCallTrace

MITRE ATT&CK mapping

Tactic Technique
Credential Access LSASS Memory (T1003.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: LSASS Memory Access — Credential Dumping
status: stable
description: Process accessing LSASS memory with read access — credential dumping
author: theadminstack.com
date: 2026/05/16
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\\lsass.exe'
        GrantedAccess|contains:
            - '0x1010'
            - '0x1410'
            - '0x1438'
            - '0x143a'
    filter_legit:
        SourceImage|contains:
            - 'MsMpEng'
            - 'SenseIR'
            - 'csrss'
    condition: selection and not filter_legit
falsepositives:
    - Security tools and EDR products
level: critical
tags:
    - attack.credential_access
    - attack.t1003.001
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 10   // Process accessed
// EventData holds: SourceImage, TargetImage, GrantedAccess, CallTrace
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Process accessed — add EventData fields: SourceImage, TargetImage, GrantedAccess, CallTrace`
Hunt event 10 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 10?

Process accessed. A process opened another process's memory. SourceImage, TargetImage, GrantedAccess (access mask) are key.

Which log records event 10?

Event 10 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 10?

Event 10 is associated with: LSASS Memory (T1003.001).

How do you detect activity around event 10?

Alert: TargetImage=lsass.exe with GrantedAccess 0x1010, 0x1410, 0x1438, 0x143a, 0x1F1FFF, 0x1FFFFF. Filter: known AV and EDR processes that legitimately read LSASS. This is the highest-fidelity LSASS dump detection available from Sysmon.