plink.exe

Command-line SSH, Telnet, and Rlogin client file version info

Program on Windows LOLRMM Freshservice 2 known copies with hashes 3 Sigma rules name it

A file of Freshservice

a remote management tool, from LOLRMM

LOLRMM lists a file named plink.exe as Freshservice’s. Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc.

Its sitehttps://www.freshworks.com/freshservice/

From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name: a copy that is the file above is not necessarily Freshservice’s.

Is it the real plink.exe?

file version info and known copies

Original namePlink in the file’s header: a renamed copy still carries it

Installed inC:\Program Files\PuTTY\

Signed bySimon Tatham

ProductPuTTY suite, Simon Tatham

DescriptionCommand-line SSH, Telnet, and Rlogin client

2 known copies

Release 0.76 · C:\Program Files\PuTTY\plink.exe · signed by Simon Tatham

45ba2d837efb9f90105d3f7570ef258102ccb0cbfb60fb38e4fd1d721a31ae3d

Release 0.74 · C:\Program Files\PuTTY\plink.exe · signed by Simon Tatham

feb29e7cc97de6950192e29f2ec117cd9b17a0095a4f68d059770a24379c3993

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name plink.exe

highPotential RDP Tunneling Via PlinkFlorian Roth (Nextron Systems)

highRenamed Plink ExecutionNasreddine Bencherchali (Nextron Systems)

mediumTunneling Tool ExecutionDaniil Yugoslavskiy, oscd.community