Help With Understanding Security Auditing in EV (Event ID 5379)


DiBBz

Member
Local time
7:24 AM
Posts
10
OS
Windows 11
Thx for taking the time to check out and help me in regards to understand and auditing security events in event viewer.

Im mostly just looking for help / closure in regards a really large volume of events that keep happening every hour ive noticed. it doesn't hurt to be cautious and thoroughly investigating these.
Every day ive noticed that about 70 to 110+ logs gets generated every hour roughly on the dot. but there is always usually a 5-10 min deviation from the last batch of logs

This is typically what the event looks like!
Code:
Credential Manager credentials were read.
Subject:
Security ID:DIBBZ\DiBBz
Account Name:DiBBz
Account Domain:DIBBZ
Logon ID:0x4AAD0
Read Operation:Enumerate Credentials
Looking into details The type and read operation sometimes cycles from 1 & %%8099 > TO > 0 & %%8100

The targetname for most of these are focused on all my emails
MicrosoftAccount:user=email address goes here
there is a few within the pile that contain
WindowsLive:(cert):name=EmailHere;serviceuri=*
And usually 1 with a (Token) variant as well

And before all these logs are generated i will always get the same [ Logon & Special Logon ] Right before they are generated 5 seconds later.

Logon: EID 4624
Subject:
Security ID:SYSTEM
Account Name:DIBBZ$
Account Domain:WORKGROUP
Logon ID:0x3E7

Logon Information:
Logon Type:5
Restricted Admin Mode:-
Remote Credential Guard:-
Virtual Account:No
Elevated Token:Yes

Impersonation Level:Impersonation

New Logon:
Security ID:SYSTEM
Account Name:SYSTEM
Account Domain:NT AUTHORITY
Logon ID:0x3E7
Linked Logon ID:0x0
Network Account Name:-
Network Account Domain:-
Logon GUID:{00000000-0000-0000-0000-000000000000}

Process Information:
Process ID:0x584
Process Name:C:\Windows\System32\services.exe

Network Information:
Workstation Name:-
Source Network Address:-
Source Port:-

Detailed Authentication Information:
Logon Process:Advapi
Authentication Package:Negotiate
Transited Services:-
Package Name (NTLM only):-
Key Length:0

Special Logon: EID 4672
Subject:
Security ID:SYSTEM
Account Name:SYSTEM
Account Domain:NT AUTHORITY
Logon ID:0x3E7

Privileges:SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
SeDelegateSessionUserImpersonatePrivilege

if Anyone can help explain and put my mind at ease, or help guide if this is something to worry about or not. and if its prone for further investigating. i appreciate the time being taken to look at this thread!
 
Windows Build/Version
24H2

My Computer My Computer

At a glance

Windows 11Ryzen 7 9800x3dCorsair Vengeance 32 GB (2 x 16 GB) DDR5-6000...RTX 2060 [SAVING FOR UPGRADE ATM]
OS
Windows 11
Computer type
PC/Desktop
CPU
Ryzen 7 9800x3d
Motherboard
Gigabyte B650 EAGLE AX
Memory
Corsair Vengeance 32 GB (2 x 16 GB) DDR5-6000 CL30 Memory
Graphics Card(s)
RTX 2060 [SAVING FOR UPGRADE ATM]
Monitor(s) Displays
2x AOC
Screen Resolution
1080p
Hard Drives
Kingston 250gb 2.5" SSD
Sabrent 1TB NVME
WD 1TB HDD
PSU
NZXT C650 Gold Modular
Case
Lianli LANCOOL 216
Cooling
ARCTIC Liquid Freezer III 280
Keyboard
Corsair K70 LUX
Mouse
Corsair Katar
Internet Speed
Gigabit 1000mbps (UP & DOWN)
Browser
Brave
4672 events are generated every time elevated privs are assigned to an authentication token, these are all the SYSTEM account which is what most of the Windows services operate as, so pretty standard to see these. 4624 these are all advapi process which typically means registry access. The logon type is 5 which means again it's a service, so normal operations.
 

My Computer My Computer

At a glance

Linux Mint
OS
Linux Mint
Computer type
Laptop
Manufacturer/Model
System76 Lemur Pro

Latest Support Threads

Back
Top Bottom