Windows Event ID 5377 — Credential Manager credentials were restored from a backup — SecOps Tools

Why event 5377 matters

Restoring credentials from attacker-controlled backup = credential injection into Credential Manager for persistent access.

How to detect it

Alert: restoration outside expected IT workflows. Verify backup source.

Log source

Security

Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Persistence	Account Manipulation (T1098)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 5377   // Credential Manager credentials were restored from a backup
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=5377
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Credential Manager credentials were restored from a backup — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 5377 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Credential Manager events

5376 Credential Manager credentials were backed up 5378 The requested credentials delegation was disallowed by policy 5379 Credential Manager credentials were read 5380 Vault credentials were found 5381 Vault credentials were listed 5382 Vault credentials were read

Frequently asked questions

What is Windows Event ID 5377?

Credential Manager credentials were restored from a backup. Credentials were restored into Credential Manager from a backup.

Which log records event 5377?

Event 5377 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 5377?

Event 5377 is associated with: Account Manipulation (T1098).

How do you detect activity around event 5377?

Alert: restoration outside expected IT workflows. Verify backup source.