telnet.exe
Sources: 300M+ executions observed in the wild.
Summary
Telnet client. Legacy unencrypted remote terminal access protocol. Not installed by default on modern Windows. Presence and use is notable — can indicate lateral movement or legacy system access.
telnet.exe is the 2232nd most commonly executed Windows program in EchoTrail's dataset, observed 231 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Get this in your tools
The same record for telnet.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/telnet.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- d1eaa232cee4856d0342273eb0f2bdb409640ea9fa0e91e58d21034cc6ddd45578.35%
- 7a1c7d7b5c77789106ea4ffd398a132825c6c97b69957d76719ff64b34628df98.23%
- d8741d3a82def076d598543e6e5695ed0fb7f4f25ccb6e247b366665e025f5a74.76%
- abcf60b8587f6d98fc72b84e00badccfcb36db1fea32350f82dad11fdbb8737b2.6%
- f706a9ffa9d135e0ed81d3d3570f09409a2ce68d6847976b225ea44f81c90f112.16%
- 782e0904389cf8a5558ac482671ddb6c974fc537c64b5bdd96104533146da72e1.3%
- c2de637757a907da8151c0922b5cf735f6cd5faabef233abff72868241dcfd0d1.3%
- 3a5690e51d298cbedd8137e3bd4addc550e848f8795916ac98446b4944adb1340.87%
- abe72a168c332e2fcb493e85290744e7153ecd109a0b5ffd7fabbaac339c673a0.43%
Process Ancestry
Top Grandparents
- explorer.exe98.87%
- cmd.exe1.13%
Top Parents
- cmd.exe97.84%
- powershell.exe1.3%
- explorer.exe0.43%
- taskhostw.exe0.43%
Security Analysis
What does telnet.exe normally do?
Not installed by default on Windows 10+. Must be enabled as an optional Windows feature. When present, runs from C:\Windows\System32. Sends all data including credentials in cleartext.
When is telnet.exe suspicious?
Any telnet.exe execution in environments that don't use telnet. Telnet being installed/enabled as a Windows feature (may indicate attacker enabling it). Connections to unusual hosts or ports. Use on servers.
How do attackers abuse telnet.exe?
LATERAL MOVEMENT: Telnet provides interactive shell access to remote systems running telnet servers (older Linux/Unix, network devices, mainframes). Credentials are transmitted in cleartext, making telnet sessions susceptible to credential capture. BANNER GRABBING: Attackers use telnet to probe service banners on arbitrary ports for reconnaissance.
Detection guidance
MEDIUM-CONFIDENCE: - Any telnet.exe execution (most environments have moved to SSH) - Telnet optional feature being enabled (DISM or optionalfeatures.exe) - Telnet connections to non-standard ports DATA SOURCES: Process creation (Sysmon 1), network connections (Sysmon 3)
False positive notes
Network engineers connecting to managed switches and routers. Legacy mainframe access. Some automated systems use telnet for device configuration.
Related Processes
Ask Rocky about telnet.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for telnet.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.