SOC Event Lookup
Event ID 5376CredentialMgrP2

Windows Event ID 5376: Credential Manager credentials were backed up

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 5376 records successful backup of the user Credential Manager database.

Technical Metadata

Technical metadata for Event ID 5376
Event ID5376
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0006 Credential Access / T1555.004 Windows Credential Manager
Key fields to watchSubjectUserName / SubjectDomainName, SubjectLogonId, Computer

Trigger Scenarios

This event is generated when the Subject successfully backs up the Credential Manager database, typically through the Credential Manager control-panel workflow.

Key Fields

SubjectUserName / SubjectDomainName

Identifies the account that performed the backup operation. Microsoft documents that this is the Subject account.

SubjectLogonId

Hexadecimal logon ID that correlates the backup to the user logon session and nearby process creation.

Computer

Identifies whether the backup occurred on a domain controller, member server, or workstation; Microsoft documents that the event can occur on all three.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 5376
SecurityEvent
| where EventID == 5376
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 5376
index=wineventlog source="WinEventLog:Security" EventCode=5376
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 5376
dataset = microsoft_windows_raw
| filter edr_event_id = 5376
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security or applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5376
title: Windows Security Event ID 5376
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5376
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID5376Credential Manager credentials were backed up successfully.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
Keywords0x8020000000000000The documented event XML marks this as a successful Security audit event.Use Keywords together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1555.004Windows Credential Manager

Detection Notes

Use threshold=1 occurrence because Microsoft states every 5376 should be recorded and that Credential Manager backup is very rarely used and can indicate malicious activity. MITRE T1555.004 explicitly notes credential backups via rundll32.exe keymgr.dll KRShowKeyMgr and Windows Credential Manager vault material under %Systemdrive%\Users\[Username]\AppData\Local\Microsoft\[Vault/Credentials]\. Correlate SubjectLogonId to 4688 for rundll32.exe, vaultcmd.exe, or unusual interactive activity before closing.

Common False Positives

  • Legitimate user-initiated credential backup through Credential Manager is possible but rare.
  • Help-desk migration workflows can intentionally back up user credentials during device replacement.

Related Events

Sample Log

Sanitized event sample
EventID: 5376
SubjectUserName: j.smith
SubjectDomainName: CORP
SubjectLogonId: 0x30d7c
Computer: WS-042

Frequently Asked Questions

What does Windows Event ID 5376 mean?

A user successfully backed up the Credential Manager database.

Does Event ID 5376 always indicate malicious activity?

It is legitimate but rare; Microsoft recommends recording every occurrence because malicious software may invoke the function.

How should Event ID 5376 be investigated?

Resolve SubjectLogonId to its logon and process activity, then validate the user migration or backup change record.

Sources