Opening a Word file got lsass read. Remember 0x1410.

How Sysmon Event ID 10 exposes lsass memory access: GrantedAccess 0x1410, CallTrace UNKNOWN, and a chain-based rule.