win:sysmon 10
ProcessAccess
The process accessed event reports when a process opens another process, an operation that's often followed by information queries or reading and writing the address space of the target process.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 70
- Rules depending on it
- Splunk 14, Sigma 29, Elastic 7, Microsoft Sentinel 1
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
- T1001.001 Junk Data
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1006 Direct Volume Access
- T1010 Application Window Discovery
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.016 Junk Code Insertion
- T1055 Process Injection
- T1055.001 Dynamic-link Library Injection
- T1055.002 Portable Executable Injection
- T1055.003 Thread Execution Hijacking
- T1055.004 Asynchronous Procedure Call
- T1055.005 Thread Local Storage
- T1055.011 Extra Window Memory Injection
- T1055.012 Process Hollowing
- T1055.013 Process Doppelgänging
- T1055.015 ListPlanting
- T1056 Input Capture
- T1056.001 Keylogging
- T1056.004 Credential API Hooking
- T1057 Process Discovery
- T1059.010 AutoHotKey & AutoIT
- T1106 Native API
- T1110.002 Password Cracking
- T1111 Multi-Factor Authentication Interception
- T1115 Clipboard Data
- T1120 Peripheral Device Discovery
- T1123 Audio Capture
- T1124 System Time Discovery
- T1127.001 MSBuild
- T1134 Access Token Manipulation
- T1134.001 Token Impersonation/Theft
- T1134.002 Create Process with Token
- T1140 Deobfuscate/Decode Files or Information
- T1185 Browser Session Hijacking
- T1195.003 Compromise Hardware Supply Chain
- T1210 Exploitation of Remote Services
- T1212 Exploitation for Credential Access
- T1216 System Script Proxy Execution
- T1216.002 SyncAppvPublishingServer
- T1218.003 CMSTP
- T1218.013 Mavinject
- T1482 Domain Trust Discovery
- T1497.001 System Checks
- T1497.002 User Activity Based Checks
- T1539 Steal Web Session Cookie
- T1546.012 Image File Execution Options Injection
- T1547.012 Print Processors
- T1548.002 Bypass User Account Control
- T1550.003 Pass the Ticket
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1555.005 Password Managers
- T1556 Modify Authentication Process
- T1556.001 Domain Controller Authentication
- T1556.008 Network Provider DLL
- T1558 Steal or Forge Kerberos Tickets
- T1558.001 Golden Ticket
- T1558.002 Silver Ticket
- T1558.003 Kerberoasting
- T1560.003 Archive via Custom Method
- T1564.010 Process Argument Spoofing
- T1574.013 KernelCallbackTable
- T1606 Forge Web Credentials
- T1620 Reflective Code Loading
Rules that depend on it
Splunk 14
- Access LSASS Memory for Dump Creation
- Detect Credential Dumping through LSASS access
- Rubeus Kerberos Ticket Exports Through Winlogon Access
- Spoolsv Suspicious Process Access
- Windows Access Token Manipulation Winlogon Duplicate Token Handle
- Windows Access Token Winlogon Duplicate Handle In Uncommon Path
- Windows Handle Duplication in Known UAC-Bypass Binaries
- Windows Hunting System Account Targeting Lsass
- Windows Non-System Account Targeting Lsass
- Windows Possible Credential Dumping
- Windows Process Injection into Commonly Abused Processes
- Windows Terminating Lsass Process
- Windows VSSVC Process Accessing Defender Engine
- Windows WMI Impersonate Token
Sigma 29
- CMSTP Execution Process Access by Nik Seetharaman
- Credential Dumping Activity By Python Based Tool by Bhabesh Raj, Jonhnathan Ribeiro
- Credential Dumping Attempt Via Svchost by Florent Labouyrie
- Credential Dumping Attempt Via WerFault by Florian Roth (Nextron Systems)
- Function Call From Undocumented COM Interface EditionUpgradeManager by oscd.community, Dmitry Uchakin
- HackTool - CobaltStrike BOF Injection Pattern by Christian Burkard (Nextron Systems)
- HackTool - Generic Process Access by Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
- HackTool - HandleKatz Duplicating LSASS Handle by Bhabesh Raj (rule), @thefLinkk
- HackTool - LittleCorporal Generated Maldoc Injection by Christian Burkard (Nextron Systems)
- HackTool - SysmonEnte Execution by Florian Roth (Nextron Systems)
- LSASS Access From Potentially White-Listed Processes by Florian Roth (Nextron Systems)
- LSASS Access From Program In Potentially Suspicious Folder by Florian Roth (Nextron Systems)
- LSASS Memory Access by Tool With Dump Keyword In Name by Florian Roth (Nextron Systems)
- Lsass Memory Dump via Comsvcs DLL by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Malware Shellcode in Verclsid Target Process by John Lambert (tech), Florian Roth (Nextron Systems)
- Potential Credential Dumping Activity Via LSASS by Samir Bousseaden, Michael Haag
- Potential Credential Dumping Attempt Via PowerShell by oscd.community, Natalia Shornikova
- Potential Direct Syscall of NtOpenProcess by Christian Burkard (Nextron Systems), Tim Shelton (FP)
- Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential Shellcode Injection by Bhabesh Raj
- Potentially Suspicious GrantedAccess Flags On LSASS by Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community
- Remote LSASS Process Access Through Windows Remote Management by Patryk Prauze - ING Tech
- Suspicious LSASS Access Via MalSecLogon by Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems)
- Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Svchost Process Access by Tim Burrell
- UAC Bypass Using WOW64 Logger DLL Hijack by Christian Burkard (Nextron Systems)
- Uncommon GrantedAccess Flags On LSASS by Florian Roth (Nextron Systems)
- Uncommon Process Access Rights For Target Image by Nasreddine Bencherchali (Nextron Systems), frack113
Elastic 7
- Potential Credential Access via DuplicateHandle in LSASS
- Potential Credential Access via LSASS Memory Dump
- Potential LSASS Memory Dump via PssCaptureSnapShot
- Suspicious LSASS Access via MalSecLogon
- Suspicious Lsass Process Access
- Suspicious Process Access via Direct System Call
- Suspicious Process Creation CallTrace
Microsoft Sentinel 1
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| Microsoft Defender for Endpoint device tables | DeviceEvents | Partial | our analysis: OpenProcessApiCall ActionType in DeviceEvents for sensitive targets (for example LSASS), not every process access |
| Elastic Defend endpoint events | api | Partial | our analysis: Elastic Defend api dataset reports selected process-access API calls |