OpsVantage Tools
Tools Guides Event IDs opsvantage.net
Tools / Event IDs / Sysmon Event ID 10

Sysmon Event ID 10: process access

What Sysmon Event ID 10 (process access) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.

Log: Microsoft-Windows-Sysmon/Operational · Severity: Informational · MITRE ATT&CK T1003.001 · Updated 2026-11-03

Sysmon Event ID 10 records one process opening another. Most of that is noise, but one target matters a lot: lsass.exe, which holds credentials in memory. Credential dumping tools have to open LSASS, and Event ID 10 is where that shows.

The fields that matter

FieldWhat it tells you
SourceImageThe process that opened the other one.
TargetImageThe process that was opened. Focus on C:\Windows\System32\lsass.exe.
GrantedAccessThe rights requested. 0x1010, 0x1410, 0x1438, 0x143a and 0x1fffff are common in dumping tools.
CallTraceThe modules in the call stack. dbghelp.dll or dbgcore.dll, or UNKNOWN entries, are red flags.

What is normal

Security products, Windows services and management agents opening LSASS for legitimate reasons.

When Sysmon Event ID 10 is suspicious

Common false positive: Antivirus and EDR products open LSASS constantly. Exclude their exact paths and signatures rather than broad names.

Find Sysmon Event ID 10 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=10; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

Event
| where TimeGenerated > ago(7d) and Source == "Microsoft-Windows-Sysmon" and EventID == 10
| project TimeGenerated, Computer, RenderedDescription, EventData
| order by TimeGenerated desc

Related events

FAQ

Why is Sysmon Event ID 10 so noisy?

Processes open each other all the time. Most configurations log only access to a few sensitive targets such as LSASS.

How do I protect LSASS?

Turn on LSA protection (RunAsPPL) and Credential Guard, and the attack surface reduction rule that blocks credential stealing from LSASS.