# Developing A Baseline For Sensitive Process Access

**URL:** <https://community.limacharlie.com/t/developing-a-baseline-for-sensitive-process-access/72>\
**Category:** LCQL Queries\
**Tags:** windows, lcql\
**Created:** [February 18, 2025, 10:57pm UTC](https://community.limacharlie.com/t/developing-a-baseline-for-sensitive-process-access/72 "2025-02-18T22:57:46Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric\_capuano](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/eric_capuano/32/4_2.png) [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\
**Post date:** [February 18, 2025, 10:57pm UTC](https://community.limacharlie.com/t/developing-a-baseline-for-sensitive-process-access/72/1 "2025-02-18T22:57:46Z")

</div>

**Description of the query:**  
A _starter_ query which leverages field projection to provide a high-level view of `SENSITIVE_PROCESS_ACCESS` activity for an org for developing a baseline or identifying outliers.

**Query:**

```auto
-24h | * | SENSITIVE_PROCESS_ACCESS | event/*/event/TARGET/FILE_PATH contains "lsass" | ts as Timestamp event/*/event/SOURCE/FILE_PATH as SOURCE event/*/event/TARGET/FILE_PATH as TARGET

```