Credential Added to Public IPv4 Address via Cmdkey.EXE

Swachchhanda Shrawan Poudel (Nextron Systems), Marius Benthin (Nextron Systems)

Detects the addition of credentials to a public IPv4 address via cmdkey.exe. Adding credential to cmdkey allows attackers to store credentials for later use. Threat Actors may use this technique to access remote systems without being prompted for credentials and use automated scripts more effectively.

2026-07-05 00:00:00

None

c29f4813-774d-40e4-b79c-fd2de305a3f9

attack.credential-access attack.t1555.004

Nextron Sigma feed only (private)