A credential was read from the Windows Vault.
Actual credential reading from Vault — the harvesting step. Mimikatz sekurlsa::credman captures vault credentials. CmdKey can list and trigger reads.
Alert: vault credential reads by unexpected processes outside normal application use.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName | Tactic | Technique |
|---|---|
| Credential Access | Windows Credential Manager (T1555.004) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5382 // Vault credentials were read
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=5382
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Vault credentials were read — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`Vault credentials were read. A credential was read from the Windows Vault.
Event 5382 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Credential Manager' subcategory (Success and/or Failure).
Event 5382 is associated with: Windows Credential Manager (T1555.004).
Alert: vault credential reads by unexpected processes outside normal application use.