---
title: "What Process Monitor detail shows Antivirus interception?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-process-monitor-detail-shows-antivirus-interception"
language: "en"
last_updated: "2026-05-29T14:31:36.899Z"
---

# What Process Monitor detail shows Antivirus interception?

In Process Monitor (ProcMon), an Antivirus (AV) or EDR interception is rarely labeled as "Blocked by AV." Instead, you have to look for specific technical indicators in the Detail column and the Stack Trace.

Here are the three specific details that confirm an AV/EDR is intercepting the Spirion Agent:

## 1\. The "Filter Driver" in the Stack Trace

This is the most definitive proof. Every AV/EDR installs a "Mini-Filter Driver" that sits between the application (`spirion.exe`) and the File System.

-   **How to see it:** Right-click an `ACCESS DENIED` line in ProcMon and select **Stack**.
-   **What to look for:** Look for driver names (ending in `.sys`) that are **not** owned by Microsoft.
-   **Common Interceptors:**
-   -   **CrowdStrike:** `csagent.sys`
    -   **SentinelOne:** `SentinelMonitor.sys`
    -   **Carbon Black:** `cbfilter.sys`
    -   **Trend Micro:** `tmmon.sys`
    -   **Symantec:** `SRTSP.sys`
-   **The Logic:** If a third-party `.sys` file appears in the stack right before the "Access Denied" result, that driver is the one that issued the denial.

## 2\. "Desired Access" vs. "Result" Discrepancy

Look at the **Detail** column for the **Desired Access** field.

-   **The Indicator:** If Spirion is only requesting `Read Attributes` or `Synchronize` (very low-level, non-invasive requests) but still receives an `ACCESS DENIED`, it is almost certainly an AV interception.
-   **Why:** Standard NTFS permissions rarely block "Read Attributes." However, an EDR will block *any* interaction from a process it has flagged as "Suspicious" or "Untrusted."

## 3\. The "Process Tree" Termination (Ctrl + T)

If the AV isn't just blocking a file but is actually "killing" the Spirion Agent because it thinks the agent is ransomware:

-   **The Detail:** In the ProcMon main view, look for the `Process Exit` event for `spirion.exe`.
-   **The Smoking Gun:** Open the **Process Tree (Ctrl + T)**. If you see `spirion.exe` end at the exact same millisecond that a security process (like `MsMpEng.exe` or `CylanceSvc.exe`) shows a spike in activity or a `Thread Create` event, the security tool forcibly terminated the agent.

* * *

## Summary Table: Process Monitor Antivirus (AV) Indicators

| ProcMon Field | What you see | Meaning |
| --- | --- | --- |
| **Result** | `ACCESS DENIED` | The request was stopped. |
| **Detail** | `Desired Access: Generic Read` | Spirion was trying to scan the file. |
| **Stack Trace** | `fltmgr.sys` -> `[Vendor].sys` | The **Filter Manager** passed the request to the AV, and the AV denied it. |
| **Operation** | `Process Exit` | The AV/EDR killed the Spirion process entirely. |

## Verification Tip

If you see `fltmgr.sys` (Microsoft's Filter Manager) at the top of the stack followed by a non-Microsoft driver, you have 100% confirmation. You can take a screenshot of that **Stack Trace** to your Security Team as proof that their tool is interfering with Spirion's operations.

## Summary

Look at the **Stack Trace** for third-party `.sys` files. If a vendor driver (like `csagent.sys`) appears in the path to the `ACCESS DENIED` result, that AV/EDR is the source of the block.