Identifier / Programs / Windows
cmdkey.exe
Creates, lists, and deletes stored user names and passwords or credentials. Windows commands reference
LOLBAS Credentials 3 Sigma rules name it 2 ATT&CK techniques 1 documented command 12 known copies with hashes
How cmdkey.exe is abused
Credentials T1078 Valid Accounts
/listDisplays the list of stored user names and credentials. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for cmdkey.exe.
1 documented command
Credentials T1078 Valid Accounts User privileges
List cached credentials
cmdkey /listTrips 2 Sigma rules: highPotential Reconnaissance For Cached Credentials Via Cmdkey.EXE by jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems); lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for cmdkey.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for cmdkey.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real cmdkey.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmdkey.exe · signed by Microsoft Windows
68e04b7b97c528f685f233eb946a4ae1d2db92cffc3fd2b16bf0d8cb11633f1f10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmdkey.exe · signed by Microsoft Windows
9ed96e0863149e65177c158a4d0dfaf7f9611575879dbbf196119047a1cee2f610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cmdkey.exe · signed by Microsoft Windows
14bcc1901c5cca8e91a6400050308752916ac861bdd52cf3a44dc7ef4683028210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmdkey.exe · signed by Microsoft Windows
da8059f55ec94dfcb0e75fa43fa6bbc794070e50defc00216fc42710cfa5882510.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cmdkey.exe · signed by Microsoft Windows
224999a92bf4108ab32bb06deb7510a534431d41b86bc527b1028c70a15705ee10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cmdkey.exe · signed by Microsoft Windows
e6ad20eb41b82eb4211211522e3fa1e2acf434766000a09b3f2bade7a120411b10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cmdkey.exe · signed by Microsoft Windows
2b9a9b9f93369bf0a4f2616398fb4a20c89567807fbfddb9aa9257ee7a0ca24110.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cmdkey.exe · signed by Microsoft Windows
ea468ef7815f4e628c295bd05ed247dcd942cd71afa991b9ec4b94d963110aa410.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\cmdkey.exe · signed by Microsoft Windows
091421e30fc90f6596bacef7ad874384d8044fc6c1487f351196bacd2d10c4ff10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cmdkey.exe · signed by Microsoft Windows
89b6a8cb5cf989e3d999482cecf779ba295871a9c80c8ca151694942d58811146.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\cmdkey.exe · not signed
df4b35dc5c0d2dbdcb9335cca97d95bea5bb1c1e78d9249e6abbe3f6bc57e81e6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\cmdkey.exe · not signed
ede0aa5307dbec6ac00d5dbce957b170702c7e4222109f8c2254b53fb67870f6From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
List all user credentials
cmdkey /listIdentify/listDisplays the list of stored user names and credentials. Windows commands referenceTrips 2 Sigma rules: highPotential Reconnaissance For Cached Credentials Via Cmdkey.EXE by jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems); lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
Matches LOLBAS abuse: Credentials (T1078)
Store credentials for a user that accesses a server
cmdkey /add:server_name /user:user_nameIdentify/addAdds a user name and password to the list. Windows commands reference/userSpecifies the user or account name to store with this entry. Windows commands referenceDelete credentials for a specific target
cmdkey /delete target_nameIdentify/deleteDeletes a user name and password from the list. Windows commands referenceOf the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of cmdkey.exe
/addAdds a user name and password to the list./genericAdds generic credentials to the list./smartcardRetrieves the credential from a smart card./userSpecifies the user or account name to store with this entry./passSpecifies the password to store with this entry./deleteDeletes a user name and password from the list./listDisplays the list of stored user names and credentials./?Displays help at the command prompt.