Windows Event ID 5376 — Credential Manager credentials were backed up

Credentials from Credential Manager were backed up (exported).

Why event 5376 matters

Credential Manager backup exports stored credentials to a file — a primary data theft vector. Attackers export credentials for offline cracking or direct use.

How to detect it

Alert on every occurrence. Verify the export was authorized and destination is secure.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

SecurityEvent
| where EventID == 5376   // Credential Manager credentials were backed up
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=5376
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Credential Manager credentials were backed up — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Related Credential Manager events