.. /Cmdkey.exe

Star

Paths:

• C:\Windows\System32\cmdkey.exe
• C:\Windows\SysWOW64\cmdkey.exe

Resources:

• https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
• https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey

Acknowledgements:

Detections:

• Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml

Credentials

1. List cached credentials

   cmdkey /list

   Use case

   Get credential information from host

   Privileges required

   User

   Operating systems

   Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   ATT&CK® technique

   T1078