Cmdkey.exe

List cached credentials

Use Get credential information from host

cmdkey /list

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Credentials

MITRE

T1078

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml

Refs

web.archive.org/web/20230202122017/https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation

docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey

lolbas-project.github.io/lolbas/Binaries/Cmdkey/