Sysmon Event ID 10: Process Access — LSASS, GrantedAccess, CallTrace

What it records

Microsoft’s description: the process accessed event “reports when a process opens another process, an operation that’s often followed by information queries or reading and writing the address space of the target process. This enables detection of hacking tools that read the memory contents of processes like Local Security Authority (Lsass.exe) in order to steal credentials for use in Pass-the-Hash attacks.”

The event pairs a source and a target: SourceImage, SourceProcessGUID, SourceProcessId, SourceThreadId and SourceUser on one side, TargetImage, TargetProcessGUID, TargetProcessId and TargetUser on the other. GrantedAccess is the access mask Windows granted, built from the rights in Microsoft’s process security and access rights table, and CallTrace is the stack of the call that opened the handle.

Because almost every security product, backup agent and system component opens other processes, Microsoft advises enabling the event only “with filters that remove expected accesses”. A typical configuration limits it to lsass.exe as the target:

<ProcessAccess onmatch="include">
  <TargetImage condition="end with">lsass.exe</TargetImage>
</ProcessAccess>

When it matters

Reading	Meaning
TargetImage is lsass.exe and GrantedAccess includes 0x0010 (PROCESS_VM_READ), e.g. 0x1010, 0x1410, 0x143a	A handle that can read LSASS memory — credential dumping (T1003.001)
GrantedAccess 0x1fffff (PROCESS_ALL_ACCESS) on lsass.exe	Full access to LSASS, which few legitimate programs ask for
SourceImage in a user, temp or public folder, or rundll32.exe / powershell.exe opening lsass.exe	A dumping tool, a dump through comsvcs.dll, or a script
CallTrace contains UNKNOWN	The request came from code not backed by a module — injected or unpacked in memory
GrantedAccess with PROCESS_VM_WRITE (0x0020) and PROCESS_CREATE_THREAD (0x0002) on another process	The rights needed to inject code (T1055); look for event 8 next

The masks are additive, so read them as bits: test for the 0x0010 bit rather than matching a fixed list, which attackers can step around by asking for slightly different rights. In hexadecimal that bit is set exactly when the second digit from the right is odd (0x1010, 0x1410, 0x143a, 0x1fffff all have it; 0x1000 and 0x1400 do not).

How to investigate

Handles to LSASS that can read its memory, from programs other than the usual Windows components:

Event
| where TimeGenerated > ago(7d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 10
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend SourceImage = tostring(f.SourceImage), TargetImage = tostring(f.TargetImage),
         GrantedAccess = tostring(f.GrantedAccess), CallTrace = tostring(f.CallTrace), Account = tostring(f.SourceUser)
| where TargetImage endswith "\\lsass.exe"
// PROCESS_VM_READ (0x0010) is set when the second hex digit from the right is odd.
| where GrantedAccess matches regex @"(?i)^0x[0-9a-f]*[13579bdf][0-9a-f]$"
| where SourceImage !startswith "C:\\Windows\\System32\\"
| project TimeGenerated, Computer, Account, SourceImage, GrantedAccess, UnbackedCode = CallTrace has "UNKNOWN", CallTrace

Every source that opened LSASS, ranked by how rare it is across the estate:

Event
| where TimeGenerated > ago(30d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 10
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend SourceImage = tostring(f.SourceImage), TargetImage = tostring(f.TargetImage), GrantedAccess = tostring(f.GrantedAccess)
| where TargetImage endswith "\\lsass.exe"
| summarize Hosts = dcount(Computer), Events = count(), Masks = make_set(GrantedAccess, 10) by SourceImage
| order by Hosts asc

For each suspicious source, follow SourceProcessGUID to its process creation event for the command line, parent and hashes, then to the logon session through LogonId and the 4624. Treat the accounts that were logged on to the host as exposed: their credentials may have been read. The Sigma rule for LSASS access expresses the same check for other SIEMs, and the free analyzer flags LSASS access in a Sysmon export.