New Generic Credentials Added Via Cmdkey.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•18

Detects the usage of "cmdkey.exe" with the '-g', '-u', and '-p' command-line arguments to add new generic credentials. This activity can be used by adversaries to store credentials for later use, potentially before connecting to remote services like RDP.