platform-os-patching-plugin.exe
Summary
Endpoint management platform plugin. Collects system state, handles patching, or manages security components depending on the plugin type.
platform-os-patching-plugin.exe is the 83rd most commonly executed Windows program in EchoTrail's dataset, observed 312,636 times across enterprise environments. It typically runs from C:\Program Files (x86)\ITSPlatform\plugin\os-patching and it is most often launched by platform-agent-core.exe.
Behavior
Top Paths
- C:\Program Files (x86)\ITSPlatform\plugin\os-patching100%
Top Hashes (SHA256)
- addf607cbaa838f6114a0b9f5f0cd79ed2308b1e2f138d82062d8047e8e7434930.13%
- 6a41dafff79e7cd72886f699f22ffc8dac533f67a9adda61d1f22e566b035cf721.04%
- 46519561337edfeffeeddbcecefbc9f4a7528225d0d6e19f829b7759b60be82517.62%
- 9450faa8d9eae5291dd968a46c923008889ed35ed88a157a98a5c9244e83fd4e10.69%
- 0b49018555a215691cee01ec92680da7bcab8d5c27aee6790aa5fefa0689a0997.58%
- 8f9fc179b0f12feb580be3fa21e69b3cd42bfee5ec6a4cb966dd231ab2312c055.96%
- 81a64f66f88d2faaead099bee5fa773aa83b6f336d49e432f665c3c788c652705.67%
- bb3e8334eff1abdf3a3215fe5dcd2a73cdf78be340d7376a96b22d784dc0522c0.88%
- 5057afd78cc65ccbc5e344a9725729b3a0bb4375c097254a97158ef06467e8e90.43%
Process Ancestry
Top Parents
- platform-agent-core.exe98.71%
Top Children
- conhost.exe99.97%
- Dism.exe0.01%
- expand.exe0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does platform-os-patching-plugin.exe normally do?
Part of an endpoint management agent. Runs continuously.
When is platform-os-patching-plugin.exe suspicious?
Running from unexpected paths.
How do attackers abuse platform-os-patching-plugin.exe?
Not commonly abused.
Detection guidance
No detection needed.
False positive notes
Normal management agent operation.
Related Processes
Ask Rocky about platform-os-patching-plugin.exe
Rocky answers questions about platform-os-patching-plugin.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.