Cmdkey.exe

type: OSBinaries

creates, lists, and deletes stored user names and passwords or credentials.

Full path

C:\Windows\System32\cmdkey.exe
C:\Windows\SysWOW64\cmdkey.exe

Commands

CredentialsUser T1078
Get credential information from host
```
cmdkey /list
```
List cached credentials
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml

Resources