Mimikatz is extensively using OpenProcess to access credentials and patch processes. This event can be monitored with sysmon (EventID 10). Here's a list of GrantedAccess values you can monitor.