Cmdkey.exe — LOLBAS

Credentials

Credential Access Windows

List cached credentials

Use Get credential information from host

cmdkey /list

Context: user
Native: Credentials
MITRE: T1078
Detection: Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml
Refs: web.archive.org/web/20230202122017/https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey
lolbas-project.github.io/lolbas/Binaries/Cmdkey/