5381 Security log · Credential Manager medium severity low volume

Windows Event ID 5381 — Vault credentials were listed

Contents of Windows Vault were enumerated.

Why event 5381 matters

Enumeration of vault to discover stored credentials before harvesting them. Tools: vaultcmd /listcreds, CmdKey /list.

How to detect it

Alert: vault enumeration by unexpected processes or users.

Log source
Security
Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).
Fields to pivot on
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic Technique
Credential Access Windows Credential Manager (T1555.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL
SecurityEvent
| where EventID == 5381   // Vault credentials were listed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=5381
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Vault credentials were listed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`
Hunt event 5381 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Credential Manager events

5376 Credential Manager credentials were backed up 5377 Credential Manager credentials were restored from a backup 5378 The requested credentials delegation was disallowed by policy 5379 Credential Manager credentials were read 5380 Vault credentials were found 5382 Vault credentials were read

Frequently asked questions

What is Windows Event ID 5381?

Vault credentials were listed. Contents of Windows Vault were enumerated.

Which log records event 5381?

Event 5381 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 5381?

Event 5381 is associated with: Windows Credential Manager (T1555.004).

How do you detect activity around event 5381?

Alert: vault enumeration by unexpected processes or users.