Windows Cmdkey.EXE Cached Credential Reconnaissance
Alerts on cmdkey.exe running with -l to enumerate cached credentials on a Windows host.
- Product
- windows
- Category
- process_creation
- Author
- jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where cmdkey.exe is invoked to list cached credentials using the command-line flag -l. Attackers can use cached credential enumeration to identify accounts and potentially support subsequent credential access. The detection relies on Windows process creation telemetry, matching cmdkey.exe by image/original filename and looking for the specific -l usage in the command line.
Reporting behind it
- peew.pwhttps://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
- technet.microsoft.comhttps://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Cmdkey.EXE Cached Credential Reconnaissance
id: fa37c657-346e-4039-89d9-4f10b66665c7
status: test
description: This rule flags process creation events where cmdkey.exe is invoked to list cached credentials using the command-line flag -l. Attackers can use cached credential enumeration to identify accounts and potentially support subsequent credential access. The detection relies on Windows process creation telemetry, matching cmdkey.exe by image/original filename and looking for the specific -l usage in the command line.
references:
- https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
- https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
- https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml
author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2024-03-05
tags:
- attack.credential-access
- attack.t1003.005
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \cmdkey.exe
- OriginalFileName: cmdkey.exe
selection_cli:
CommandLine|contains|windash: " -l"
condition: all of selection*
falsepositives:
- Legitimate administrative tasks
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_recon/info.yml
simulation:
- type: atomic-red-team
name: Cached Credential Dump via Cmdkey
technique: T1003.005
atomic_guid: 56506854-89d6-46a3-9804-b7fde90791f9
license: DRL-1.1
related:
- id: 07f8bdc2-c9b3-472a-9817-5a670b872f53
type: derived