LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Cmdkey.exe

View source

creates, lists, and deletes stored user names and passwords or credentials.

01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Credentials1

EXAMPLE 01T1078

List cached credentials

COMMAND
cmdkey /list
USE CASE
Get credential information from host
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\cmdkey.exe
C:\Windows\SysWOW64\cmdkey.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources