Windows EventInformation
Windows Event ID 5376 – Microsoft-Windows-Security-Auditing: Credential Manager Credentials Were Backed Up
Event ID 5376 fires when Windows Credential Manager credentials are backed up to a file or external location, indicating potential security activity that requires monitoring.