diff --git a/atomics/T1003.005.yaml b/atomics/T1003.005.yaml
new file mode 100644
index 00000000..c09b2e5e
--- /dev/null
+++ b/atomics/T1003.005.yaml
@@ -0,0 +1,17 @@
+attack_technique: T1003.005
+display_name: 'OS Credential Dumping: Cached Domain Credentials'
+atomic_tests:
+- name: Cached Credential Dump via Cmdkey
+  description: |
+    List credentials currently stored on the host via the built-in Windows utility cmdkey.exe
+    Credentials listed with Cmdkey only pertain to the current user
+    Passwords will not be displayed once they are stored
+    https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey
+    https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
+  supported_platforms:
+    - windows
+  executor:
+  - name: command_prompt
+    elevation_required: false
+    command: |
+      cmdkey /list