Sysmon Event 10 LSASS access

Sysmon config: <ProcessAccess onmatch='include'><TargetImage condition='is'>lsass.exe</TargetImage></ProcessAccess>

Configure Sysmon (Event 10) to log all access to lsass.exe, the signature of credential dumping attempts.

Deploy this Sysmon rule on endpoints when you want full visibility into who opens handles against lsass.exe — the process that stores credentials in memory. Any dump (mimikatz sekurlsa, procdump -ma lsass, comsvcs.dll) requires opening a handle with memory read permissions, and Event 10 logs it with the source process and requested permissions. It's the go-to detection for credential dumping on the endpoint. The rule must go in the ProcessAccess section of your Sysmon configuration, and the rest of the config must already be deployed: without Sysmon installed, there's no event.

Don't use it without a downstream filtering process: lsass.exe receives legitimate accesses constantly (Windows itself, antivirus, management tools) and Event 10 without filters is a waterfall of noise that drowns the SIEM. You need the variant with GrantedAccess (BLUE·013) or correlation with unsigned processes. It's also useless if the attacker uses techniques that avoid direct access (dumping from kernel, or via shadow copy of ntds.dit on the DC — that doesn't touch endpoint lsass). And watch out for PPL environments: access to protected lsass generates different events that this rule doesn't see.