Windows Event ID 5615 – Security: Credential Manager Vault Access

Start by examining the specific details of Event ID 5615 to understand what credential was accessed and by which process.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5615 by right-clicking the Security log and selecting Filter Current Log
4. Enter 5615 in the Event IDs field and click OK
5. Double-click on a recent Event ID 5615 entry to view detailed information
6. Review the following key fields in the event details:
   • Subject: Shows the user account that accessed the credential
   • Process Information: Identifies the executable that requested the credential
   • Credential Information: Displays the target name and type of credential accessed
   • Additional Information: Contains the credential's target server or resource

Use this information to determine if the credential access was legitimate or potentially suspicious based on the requesting process and user context.

Use PowerShell to analyze Event ID 5615 patterns and identify frequent credential access activities across your environment.

1. Open PowerShell as Administrator
2. Query recent Event ID 5615 entries with detailed information:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5615} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='Process';Expression={$_.Properties[9].Value}}, @{Name='CredentialName';Expression={$_.Properties[2].Value}} | Format-Table -AutoSize

3. Analyze credential access frequency by process:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5615} -MaxEvents 200 | ForEach-Object { $_.Properties[9].Value } | Group-Object | Sort-Object Count -Descending | Select-Object Name, Count

4. Check for credential access outside business hours:

   $StartTime = (Get-Date).Date.AddHours(18)
   $EndTime = (Get-Date).Date.AddDays(1).AddHours(8)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5615; StartTime=$StartTime; EndTime=$EndTime} | Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='Process';Expression={$_.Properties[9].Value}}

5. Export results for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5615} -MaxEvents 500 | Select-Object TimeCreated, Id, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='Process';Expression={$_.Properties[9].Value}} | Export-Csv -Path "C:\Temp\Event5615_Analysis.csv" -NoTypeInformation

Examine the current contents of the Credential Manager vault to understand what credentials are stored and potentially being accessed.

1. Open Credential Manager by typing credential manager in the Start menu search
2. Review both Web Credentials and Windows Credentials sections
3. Note any suspicious or unexpected stored credentials
4. Use PowerShell to enumerate stored credentials programmatically:

   cmdkey /list

5. For more detailed credential information, use the Windows Credential Management API through PowerShell:

   Add-Type -AssemblyName System.Security
   $creds = [System.Security.Cryptography.ProtectedData]::Unprotect
   # Note: Direct credential enumeration requires elevated privileges

6. Check for recently modified credential entries by examining file timestamps in the credential store location:

   Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Credentials" -Force | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, Length

7. Review vault policy settings in Group Policy:
   • Navigate to Computer Configuration → Administrative Templates → System → Credentials Delegation
   • Check policies like "Allow delegating default credentials" and "Allow delegating default credentials with NTLM-only server authentication"

Enhance credential access monitoring by configuring detailed audit policies and implementing additional security measures.

1. Enable advanced credential auditing through Group Policy:
   • Open Group Policy Management Console (gpmc.msc)
   • Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration
   • Expand Object Access and configure Audit Credential Validation for both Success and Failure
2. Configure local audit policy via command line:

   auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable

3. Set up Windows Event Forwarding to centralize Event ID 5615 collection:

   wecutil cs subscription.xml

4. Create a custom XML subscription file for credential events:

   <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
     <SubscriptionId>CredentialAccess</SubscriptionId>
     <Query>
       <![CDATA[
         <QueryList>
           <Query Id="0">
             <Select Path="Security">*[System[EventID=5615]]</Select>
           </Query>
         </QueryList>
       ]]>
     </Query>
   </Subscription>

5. Implement credential guard on supported systems:

   Enable-WindowsOptionalFeature -Online -FeatureName IsolatedUserMode
   Enable-WindowsOptionalFeature -Online -FeatureName HypervisorPlatform

6. Configure registry settings to enhance credential protection:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LsaCfgFlags" -Value 1 -Type DWord

Deploy automated monitoring and response capabilities to detect and respond to suspicious credential access patterns.

1. Create a PowerShell script for real-time Event ID 5615 monitoring:

   Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Security' AND EventCode=5615" -Action {
       $Event = $Event.SourceEventArgs.NewEvent
       $ProcessName = $Event.InsertionStrings[9]
       $User = $Event.InsertionStrings[1]
       
       # Check for suspicious processes
       $SuspiciousProcesses = @('mimikatz.exe', 'procdump.exe', 'pwdump.exe')
       if ($SuspiciousProcesses -contains $ProcessName) {
           Write-EventLog -LogName Application -Source "Security Monitor" -EventId 1001 -EntryType Warning -Message "Suspicious credential access detected: $ProcessName by $User"
       }
   }

2. Set up Windows Performance Toolkit (WPT) for advanced credential access tracing:

   wpr -start GeneralProfile -filemode
   # Reproduce credential access scenario
   wpr -stop C:\Temp\credential_trace.etl

3. Configure Sysmon for enhanced process monitoring related to credential access:

   <Sysmon schemaversion="4.82">
     <EventFiltering>
       <ProcessCreate onmatch="include">
         <Image condition="contains">lsass.exe</Image>
         <Image condition="contains">winlogon.exe</Image>
       </ProcessCreate>
     </EventFiltering>
   </Sysmon>

4. Implement threat hunting queries using KQL for Microsoft Sentinel:

   SecurityEvent
   | where EventID == 5615
   | extend ProcessName = tostring(EventData.ProcessName)
   | extend TargetUserName = tostring(EventData.TargetUserName)
   | summarize count() by ProcessName, TargetUserName, bin(TimeGenerated, 1h)
   | where count_ > 10

5. Create custom Windows Event Log channels for credential monitoring:

   wevtutil im credential-monitoring.xml

6. Deploy Microsoft Defender for Identity to correlate credential access with other security events
7. Configure alerting rules in your SIEM solution to trigger on:
   • High-frequency credential access from single processes
   • Credential access from unusual processes or locations
   • After-hours credential access patterns
   • Credential access following other suspicious activities