Author: Tony Knutson
Description: Credential Manager credentials were read
EventId: 5379
Channel: Security
Provider: Microsoft-Windows-Security-Auditing
Maps:
  -
    Property: ExecutableInfo
    PropertyValue: "%TargetName%"
    Values:
      -
        Name: TargetName
        Value: "/Event/EventData/Data[@Name=\"TargetName\"]"
  -
    Property: UserName
    PropertyValue: "%SubjectUserName%"
    Values:
      -
        Name: SubjectUserName
        Value: "/Event/EventData/Data[@Name=\"SubjectUserName\"]"
  -
    Property: PayloadData1
    PropertyValue: "SID: %SubjectUserSid%"
    Values:
      -
        Name: SubjectUserSid
        Value: "/Event/EventData/Data[@Name=\"SubjectUserSid\"]"
  -
    Property: PayloadData2
    PropertyValue: "Domain: %SubjectDomainName%"
    Values:
      -
        Name: SubjectDomainName
        Value: "/Event/EventData/Data[@Name=\"SubjectDomainName\"]"
  -
    Property: PayloadData3
    PropertyValue: "LogonID: %SubjectLogonId%"
    Values:
      -
        Name: SubjectLogonId
        Value: "/Event/EventData/Data[@Name=\"SubjectLogonId\"]"
  -
    Property: PayloadData4
    PropertyValue: "CountOfCredentialsReturned: %CountOfCredentialsReturned%"
    Values:
      -
        Name: CountOfCredentialsReturned
        Value: "/Event/EventData/Data[@Name=\"CountOfCredentialsReturned\"]"
  -
    Property: PayloadData6
    PropertyValue: "ActivityID: %ActivityID%"
    Values:
      -
        Name: ActivityID
        Value: "/Event/System/Correlation/@ActivityID"

# Documentation:
# https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5379
# https://www.socinvestigation.com/windows-event-id-5379-to-detect-malicious-password-protected-file-unlock/
# https://github.com/nasbench/EVTX-ETW-Resources/blob/main/ETWProvidersCSVs/Internal/Microsoft-Windows-Security-Auditing.csv
#
# Example Event Data:
# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
# <System>
#  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
#  <EventID>5379</EventID>
#  <Version>0</Version>
#  <Level>0</Level>
#  <Task>13824</Task>
#  <Opcode>0</Opcode>
#  <Keywords>0x8020000000000000</Keywords>
#  <TimeCreated SystemTime="YYYY-MM-DD hh:mm:ssZ" />
#  <EventRecordID>772430</EventRecordID>
#  <Correlation ActivityID="{f762f5b4-bee5-4faa-a9a9-fdaa6ea76589}" />
#  <Execution ProcessID="788" ThreadID="828" />
#  <Channel>Security</Channel>
#  <Computer>COMPUTER NAME</Computer>
#  <Security />
# </System>
# <EventData>
#  <Data Name="SubjectUserSid">SID</Data>
#  <Data Name="SubjectUserName">Username</Data>
#  <Data Name="SubjectDomainName">Domain</Data>
#  <Data Name="SubjectLogonId">0x3e7</Data>
#  <Data Name="TargetName">TARGET</Data>
#  <Data Name="Type">0</Data>
#  <Data Name="CountOfCredentialsReturned">0</Data>
#  <Data Name="ReadOperation">%%8100</Data>
#  <Data Name="ReturnCode">3221226021</Data>
#  <Data Name="ProcessCreationTime">YYYY-MM-DD hh:mm:ssZ</Data>
#  <Data Name="ClientProcessId">1448</Data>
# </EventData>
# </Event>
