Sysmon Event 10 GrantedAccess LSASS

Sysmon config: <ProcessAccess onmatch='include'><TargetImage condition='is'>lsass.exe</TargetImage><GrantedAccess condition='contains'>0x1010</GrantedAccess></ProcessAccess>

Fine-grained Sysmon rule (Event 10) that alerts only when access to lsass.exe requests memory read permissions (GrantedAccess 0x1010).

Deploy this rule when the generic ProcessAccess version (BLUE·004) generates too much noise and you need the surgical variant: filter by the exact permissions used by dumping tools. Access with 0x1010 (PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_READ) is the pattern of mimikatz, procdump -ma, and comsvcs.dll MiniDump. With this rule, Event 10 is only generated when someone asks to read lsass memory — the rest of legitimate handles (management, antivirus with other access types) do not trigger. It's the configuration that mature blue teams use in production because it reduces noise without losing the signal.

Do not use it if your environment has security or monitoring tools that legitimately open lsass with 0x1010 (some AV/EDR do this to scan memory): you will have constant false positives and the rule will end up silenced. In those environments, combine with a SourceImage filter (only unsigned processes or outside known paths). It also does not cover accesses with other values that also reveal dumping (0x143a, 0x1410): if the attacker uses a different value, this rule won't see it — consider including all three. And remember: dumping via PPL bypass or from kernel does not touch lsass with these permissions.