.. /Cmdkey.exe
Star

creates, lists, and deletes stored user names and passwords or credentials.

Paths:

C:\Windows\System32\cmdkey.exe
C:\Windows\SysWOW64\cmdkey.exe

Resources:

Acknowledgements:

Detection:

Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml

Credentials

List cached credentials
```
cmdkey /list
```
Use case
Get credential information from host

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1078