SOC Event Lookup
Event ID 10ProcessP1

Sysmon Event ID 10: ProcessAccess

Applicable version
Sysmon 1.0 and later; ProcessAccess logging must be enabled
Last reviewed
2026-07-21

Quick summary

Sysmon Event ID 10 records one process opening another process and is a key source for detecting credential dumping, process inspection, and suspicious cross-process access.

Technical Metadata

Technical metadata for Event ID 10
Event ID10
ProviderMicrosoft-Windows-Sysmon
ChannelMicrosoft-Windows-Sysmon/Operational
LevelInformational
MITRE ATT&CKTA0006 Credential Access / T1003.001 OS Credential Dumping: LSASS Memory
Key fields to watchSourceImage, TargetImage, GrantedAccess, CallTrace

Trigger Scenarios

The event is generated when a process opens a handle to another process under the configured Sysmon rules. Because the event can be noisy, collection should focus on sensitive target processes and meaningful access rights.

Key Fields

SourceImage

The executable requesting access. Its path, signer, command line, and parent process are central to determining whether the access is expected.

TargetImage

The process being accessed. lsass.exe is a high-priority target because access with sensitive rights can indicate credential theft.

GrantedAccess

The access mask granted to the source process. Interpret this alongside the target and source process because valid tools may require some overlapping rights.

CallTrace

The recorded call stack can help distinguish known security or management tools from unknown access paths, although symbols and modules may be incomplete.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Sysmon Event ID 10
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 10
| project TimeGenerated, Computer, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel Event table
Assumptions
The Sysmon Operational channel is collected into Event and retains RenderedDescription. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Sysmon Event ID 10
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
| table _time, host, user, EventCode, Message
Data source
Splunk Sysmon event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Sysmon Event ID 10
dataset = microsoft_windows_raw
| filter edr_event_id = 10
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Sysmon Operational channel is ingested into Cortex XDR. Event ID 10 is not globally unique; confirm Provider is Microsoft-Windows-Sysmon before applying Sysmon field semantics.
Query reference
Sigma rule: Sysmon Event ID 10
title: Sysmon Event ID 10
status: experimental
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 10
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Sysmon log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
GrantedAccess0x1010The mask combines PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_VM_READ (0x0010).Against lsass.exe, these rights allow querying and reading process memory; validate expected security products before treating the access as credential dumping. Source

MITRE ATT&CK Mapping

  • T1003.001OS Credential Dumping: LSASS Memory

Detection Notes

T1003.001 LSASS Memory triage is concrete when TargetImage is lsass.exe and GrantedAccess includes 0x1010, combining process-query and virtual-memory-read rights, from a source outside approved security-product paths. The mask alone is not proof of dumping; join SourceProcessGuid to Event ID 1 and evaluate signer, path, user, and CallTrace.

Common False Positives

  • EDR, antivirus, backup, monitoring, and accessibility products often inspect other processes.
  • Task Manager, debuggers, and performance tools can request process handles during normal administration.
  • Broad ProcessAccess collection without filters can create large volumes that obscure high-risk activity.

Related Events

Sample Log

Sanitized event sample
UtcTime: 2026-07-10 03:20:22.000
SourceImage: C:\Users\jsmith\AppData\Local\Temp\diagnostic.exe
TargetImage: C:\Windows\System32\lsass.exe
GrantedAccess: 0x1010
CallTrace: C:\Windows\SYSTEM32\ntdll.dll+9d4c|UNKNOWN(000001F4A1230000)

Frequently Asked Questions

What does Sysmon Event ID 10 record?

Sysmon Event ID 10 records one process opening another process and includes source, target, granted access, and call-trace context.

Why is access to lsass.exe important?

LSASS holds authentication material, so unexpected processes requesting memory-read rights can support credential-dumping detection, while security products and system components require allowlisting.

Does GrantedAccess 0x1010 prove credential dumping?

No. It includes query and virtual-memory read rights, but the target, source signer and path, call trace, user context, and related behavior determine whether the access is suspicious.

Sources

Machine-readable JSON