What Process Monitor detail shows Antivirus interception?

In Process Monitor (ProcMon), an Antivirus (AV) or EDR interception is rarely labeled as "Blocked by AV." Instead, you have to look for specific technical indicators in the Detail column and the Stack Trace.

Here are the three specific details that confirm an AV/EDR is intercepting the Spirion Agent:

1. The "Filter Driver" in the Stack Trace

This is the most definitive proof. Every AV/EDR installs a "Mini-Filter Driver" that sits between the application (spirion.exe) and the File System.

How to see it: Right-click an ACCESS DENIED line in ProcMon and select Stack.
What to look for: Look for driver names (ending in .sys) that are not owned by Microsoft.
Common Interceptors:
- CrowdStrike: csagent.sys
- SentinelOne: SentinelMonitor.sys
- Carbon Black: cbfilter.sys
- Trend Micro: tmmon.sys
- Symantec: SRTSP.sys
The Logic: If a third-party .sys file appears in the stack right before the "Access Denied" result, that driver is the one that issued the denial.

2. "Desired Access" vs. "Result" Discrepancy

Look at the Detail column for the Desired Access field.

The Indicator: If Spirion is only requesting Read Attributes or Synchronize (very low-level, non-invasive requests) but still receives an ACCESS DENIED, it is almost certainly an AV interception.
Why: Standard NTFS permissions rarely block "Read Attributes." However, an EDR will block any interaction from a process it has flagged as "Suspicious" or "Untrusted."

3. The "Process Tree" Termination (Ctrl + T)

If the AV isn't just blocking a file but is actually "killing" the Spirion Agent because it thinks the agent is ransomware:

The Detail: In the ProcMon main view, look for the Process Exit event for spirion.exe.
The Smoking Gun: Open the Process Tree (Ctrl + T). If you see spirion.exe end at the exact same millisecond that a security process (like MsMpEng.exe or CylanceSvc.exe) shows a spike in activity or a Thread Create event, the security tool forcibly terminated the agent.

Summary Table: Process Monitor Antivirus (AV) Indicators

ProcMon Field	What you see	Meaning
Result	`ACCESS DENIED`	The request was stopped.
Detail	`Desired Access: Generic Read`	Spirion was trying to scan the file.
Stack Trace	`fltmgr.sys` -> `[Vendor].sys`	The Filter Manager passed the request to the AV, and the AV denied it.
Operation	`Process Exit`	The AV/EDR killed the Spirion process entirely.

Verification Tip

If you see fltmgr.sys (Microsoft's Filter Manager) at the top of the stack followed by a non-Microsoft driver, you have 100% confirmation. You can take a screenshot of that Stack Trace to your Security Team as proof that their tool is interfering with Spirion's operations.

Summary

Look at the Stack Trace for third-party .sys files. If a vendor driver (like csagent.sys) appears in the path to the ACCESS DENIED result, that AV/EDR is the source of the block.