SOC Event Lookup
Event ID 5377CredentialMgrP2

Windows Event ID 5377: Credential Manager credentials were restored from backup

Applicable version
Windows Server 2008 R2 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 5377 records successful restore of the user Credential Manager database from backup.

Technical Metadata

Technical metadata for Event ID 5377
Event ID5377
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0006 Credential Access / T1555.004 Windows Credential Manager
Key fields to watchSubjectUserName / SubjectDomainName, SubjectLogonId, Computer

Trigger Scenarios

This event is generated when the Subject successfully restores the Credential Manager database, typically through the Credential Manager control-panel workflow.

Key Fields

SubjectUserName / SubjectDomainName

Identifies the account that performed the restore operation. Microsoft documents that this is the Subject account.

SubjectLogonId

Hexadecimal logon ID that correlates the restore to the user logon session and nearby process creation.

Computer

Identifies whether the restore occurred on a domain controller, member server, or workstation; Microsoft documents that the event can occur on all three.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 5377
SecurityEvent
| where EventID == 5377
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 5377
index=wineventlog source="WinEventLog:Security" EventCode=5377
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the event-specific field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 5377
dataset = microsoft_windows_raw
| filter edr_event_id = 5377
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security or applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 5377
title: Windows Security Event ID 5377
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5377
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented field conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
EventID5377Credential Manager credentials were restored successfully.Use EventID together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source
Keywords0x8020000000000000The documented event XML marks this as a successful Security audit event.Use Keywords together with the other documented event fields and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1555.004Windows Credential Manager

Detection Notes

Use threshold=1 occurrence because Microsoft states every 5377 should be recorded and that restoring Credential Manager credentials is very rarely used and can indicate malicious activity. MITRE T1555.004 notes that Credential Manager backup and restoration can be reached through rundll32.exe keymgr.dll KRShowKeyMgr; a restore followed by 4624 access to network resources can indicate imported credentials. Correlate SubjectLogonId to 4688 and validate the user migration ticket.

Common False Positives

  • Legitimate restore through Credential Manager can occur during user migration or device replacement.
  • Administrative support activity may restore user credentials with the user present, but it should have a ticket.

Related Events

Sample Log

Sanitized event sample
EventID: 5377
SubjectUserName: j.smith
SubjectDomainName: CORP
SubjectLogonId: 0x30d7c
Computer: WS-042

Frequently Asked Questions

What does Windows Event ID 5377 mean?

A user successfully restored a Credential Manager database backup.

Does Event ID 5377 always indicate malicious activity?

It can import stored credentials, but authorized migration and recovery workflows can also generate it.

How should Event ID 5377 be investigated?

Correlate SubjectLogonId with process creation and validate the backup source, user intent, and subsequent network logons.

Sources