Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•27

This rule detects the execution of 'cmdkey.exe' with the '-l' argument, which is used to list cached credentials on a Windows system. This activity is often associated with reconnaissance for cached credentials by adversaries.