telnet.exe
Summary
Telnet client. Legacy unencrypted remote terminal access protocol. Not installed by default on modern Windows. Presence and use is notable — can indicate lateral movement or legacy system access.
telnet.exe is the 2232nd most commonly executed Windows program in EchoTrail's dataset, observed 231 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- d1eaa232cee4856d0342273eb0f2bdb409640ea9fa0e91e58d21034cc6ddd45578.35%
- 7a1c7d7b5c77789106ea4ffd398a132825c6c97b69957d76719ff64b34628df98.23%
- d8741d3a82def076d598543e6e5695ed0fb7f4f25ccb6e247b366665e025f5a74.76%
- abcf60b8587f6d98fc72b84e00badccfcb36db1fea32350f82dad11fdbb8737b2.6%
- f706a9ffa9d135e0ed81d3d3570f09409a2ce68d6847976b225ea44f81c90f112.16%
- 782e0904389cf8a5558ac482671ddb6c974fc537c64b5bdd96104533146da72e1.3%
- c2de637757a907da8151c0922b5cf735f6cd5faabef233abff72868241dcfd0d1.3%
- 3a5690e51d298cbedd8137e3bd4addc550e848f8795916ac98446b4944adb1340.87%
- abe72a168c332e2fcb493e85290744e7153ecd109a0b5ffd7fabbaac339c673a0.43%
Process Ancestry
Top Grandparents
- explorer.exe98.87%
- cmd.exe1.13%
Top Parents
- cmd.exe97.84%
- powershell.exe1.3%
- explorer.exe0.43%
- taskhostw.exe0.43%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does telnet.exe normally do?
Not installed by default on Windows 10+. Must be enabled as an optional Windows feature. When present, runs from C:\Windows\System32. Sends all data including credentials in cleartext.
When is telnet.exe suspicious?
Any telnet.exe execution in environments that don't use telnet. Telnet being installed/enabled as a Windows feature (may indicate attacker enabling it). Connections to unusual hosts or ports. Use on servers.
How do attackers abuse telnet.exe?
LATERAL MOVEMENT: Telnet provides interactive shell access to remote systems running telnet servers (older Linux/Unix, network devices, mainframes). Credentials are transmitted in cleartext, making telnet sessions susceptible to credential capture. BANNER GRABBING: Attackers use telnet to probe service banners on arbitrary ports for reconnaissance.
Detection guidance
MEDIUM-CONFIDENCE: - Any telnet.exe execution (most environments have moved to SSH) - Telnet optional feature being enabled (DISM or optionalfeatures.exe) - Telnet connections to non-standard ports DATA SOURCES: Process creation (Sysmon 1), network connections (Sysmon 3)
False positive notes
Network engineers connecting to managed switches and routers. Legacy mainframe access. Some automated systems use telnet for device configuration.
Related Processes
Ask Rocky about telnet.exe
Rocky answers questions about telnet.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.