Windows Event ID 5379 — Credential Manager credentials were read — SecOps Tools

Why event 5379 matters

Credential Manager harvesting for lateral movement. Tools: CmdKey /list reveals stored credentials. Mimikatz sekurlsa::credman dumps Credential Manager. Windows Vault contains RDP credentials and other stored passwords.

How to detect it

Alert: Credential Manager read by unexpected processes (PowerShell, cmd). Alert: mass reads from Credential Manager (tool harvesting all stored credentials).

Log source

Security

Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Credential Access	Credentials from Password Stores: Windows Credential Manager (T1555.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 5379   // Credential Manager credentials were read
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=5379
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Credential Manager credentials were read — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 5379 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Credential Manager events

5376 Credential Manager credentials were backed up 5377 Credential Manager credentials were restored from a backup 5378 The requested credentials delegation was disallowed by policy 5380 Vault credentials were found 5381 Vault credentials were listed 5382 Vault credentials were read

Frequently asked questions

What is Windows Event ID 5379?

Credential Manager credentials were read. Credentials were read from Credential Manager. SubjectUserName and ProcessCreationTime are key.

Which log records event 5379?

Event 5379 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 5379?

Event 5379 is associated with: Credentials from Password Stores: Windows Credential Manager (T1555.004).

How do you detect activity around event 5379?

Alert: Credential Manager read by unexpected processes (PowerShell, cmd). Alert: mass reads from Credential Manager (tool harvesting all stored credentials).