cmdkey.exe /list — Credential Manager Enumeration via LOLBAS

Renata Cardoso@rcardososec

•updated Jul 1, 2026•2•0•5

Detects the execution of cmdkey.exe with the /list flag, which is used to enumerate credentials stored in the Windows Credential Manager. This technique is often used by adversaries for post-compromise reconnaissance to identify stored credentials for lateral movement.