🖥️
Windows DFIR
  • Introduction
  • Windows Artifacts
    • Windows Quick Tips
      • Windows Command Line
      • Workstation File/Folder Locations
      • Server File/Folder Locations
    • Account Usage
      • Authentications SAM Artifacts
        • Last Login
        • Last Failed Login
        • Last Password Change
      • Authentications (Windows Event Log)
        • Logon ID
      • Group Membership
        • Event ID: 4798
        • Event ID: 4799
      • RDP
        • Source System Artifacts - Quick Reference
        • Destination System Artifacts - Quick Reference
      • SSH
      • Rouge Local Accounts
      • CrowdStrike Searches
        • Event Name - UserLogon
        • Event Name - UserLogonFailed
        • Event Name - UserLogonFailed2
        • Event Name - SsoApplicationAccess
    • Browser Usage
      • History & Downloads
        • Viewing History Files - DB Browser
        • Transition Types
      • Auto-Complete Data
      • Bookmarks
      • Browser Preferences
      • Cache
      • Cookies
      • Extensions
      • Super Cookies (HTML5 Web Storage)
      • Media History
      • Private Browsing
      • Session Restore
      • Stored Credentials
      • Suggested/Frequent Sites
      • DB Browser Queries
        • Firefox
        • Chrome
        • Media History
      • PowerShell Scripts
        • Browser Extension Finder
        • Browser History Finder
    • Processes
      • at.exe
      • explorer.exe
      • lsass.exe
      • lsaiso.exe
      • PuTTy.exe
        • X11 Forwarding
      • runtimebroker.exe
      • services.exe
      • smss.exe
      • System
      • svchost.exe
        • Services
      • winlogon.exe
      • wininit.exe
    • Cloud Storage
    • Deleted File or File Knowledge
      • WordWheelQuery (Win 7+)
      • ACMRU (Win XP)
      • Internet Explorer file:///
      • Last Visited MRU
      • Thumbs.db (Win XP)
      • Thumbcache
      • Recycle Bin
      • User Typed Paths
      • Windows Search Database
    • File Download
      • Zone.Identifer
      • Open/Save Most Recently Used (MRU)
      • Email
      • Drive By Downloads
        • Malvertising
      • Web Browsing
        • Cache Files
      • CrowdStrike Searches
        • MoTW
    • Folder/File Opening/Creation
      • Recent Files
      • Office Recent Files
      • Shell Bags
      • .lnk Files
      • Jump Lists
        • AppIDs
      • Prefetch
      • Index.dat file://
      • PowerShell Scripts
        • .lnk Files
    • Persistence
      • Registry
        • NTUSER.DAT & HKU\SID
        • Run and Run Once
        • Shell Folders and UserInit Key
        • Services
        • Logon Scripts
        • Office Add-ins
        • Winlogon Shell
        • Image File Execution Options (IFEO)
        • AppInit_DLLs
        • Scheduled Tasks
      • Scheduled Tasks
        • Scheduled Task Destination System Artifacts
        • Scheduled Task Source System Artifacts
      • Startup
      • Tool: AutoRuns
      • Accounts
      • WMI Event Consumers
        • WMI: Source System Artifacts
        • WMI: Destination System Artifacts
        • WMI: PowerShell Analysis
      • PowerShell Scripts
        • Startup Programs
      • CrowdStrike Searches
        • Files Written to Startup Folder
        • Files Written to Startup Folder from the Internet
        • Local Account Creation/Deletion
        • Azure Account Creation/Deletion
        • Scheduled Tasks
    • Physical Location
      • Time zone
      • Wireless SSID
      • Network History (Vista/Win7–11)
      • Cookies
      • Browser Search Terms
    • Program Execution
      • Prefetch
        • Decoding Prefetch Files with Eric Zimmerman's PECmd Tool
      • BAM/DAM
      • CapabilityAccessManager
      • UserAssist
      • Last Visited MRU
      • RunMRU
      • MUI Cache
      • ShimCache
      • Amcache
      • Jump Lists
    • Shadow Copies
      • VSC Permissions
      • Event ID 8193: Volume Shadow Copy Service Error
    • USB Usage
      • Key Identification
      • Drive Letter and Volume Name
      • Connection Timestamps
      • User
      • Volume Name
      • Plug & Play Event Log
    • Windows Services
      • DoSvc (Delivery Optimization)
    • System Information
    • Event IDs
      • Authentication / Account
        • 4624 - Authentication Success
          • Logon Types
        • 4625 - Authentication Failure
          • SubStatus Codes
        • 4634 - Account Logoff
        • 4648 - Explicit Credentials Success
        • 4672 - Special Privileges
        • 4720 - Account Creation
        • 4722 - Account Enabled
        • 4732 - Addition to Local Group
        • 4738 - Account Changed
        • 4776 - Kerberos Authentication Attempt
          • Substatus Codes
        • 4771 - Kerberos Failure
        • 4768
      • File System
        • 1006
        • 4688 - Process Created
        • 4663
        • 4656
        • 6416
        • 20001
        • 20003
  • Windows DFIR & MITTR
    • Initial Access
      • Content Injection
      • Drive-by Compromise
        • Watering Hole Attack
        • Microsoft Files (Payload Execution)
        • Exploit Delivery
        • Viewing Browser History Files
      • Phishing
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
      • Logon ID
    • Discovery
    • Lateral Movement
    • Collection
    • Command and Control
    • Exfiltration
    • Impact
  • SOC Related
    • Cached Credentials
    • Domain Controller Password Spraying
Powered by GitBook
On this page

Was this helpful?

  1. Windows Artifacts
  2. Processes

PuTTy.exe

PuTTY is an open-source terminal emulator, serial console, and network file transfer application. It supports several network protocols, including SSH, Telnet, SCP, and SFTP, making it a versatile tool for remote administration of systems. Below is a detailed exploration of PuTTY, including its functionalities, usage examples, common file paths, and behaviors.

Overview

  • Executable Path: Typically, PuTTY.exe is located in the directory where it was installed or downloaded, often directly accessed by the user rather than being installed in a system directory.

    • If installed, its likely in the C:\Program Files folder.

  • Parent Process: As a standalone application, the parent process is usually explorer.exe or a command shell from which it was launched.

  • Number of Instances: There can be multiple instances running simultaneously, each managing a separate connection.

  • User Account: Runs under the context of the user who initiated the application.

  • Start Time: Starts when the user initiates an SSH or another protocol connection.

  • Description: PuTTY provides a user interface to remotely access computers over various network protocols. It is widely used for secure shell access to Unix and Linux systems.

Key Functions

  • SSH Connections: Secure Shell (SSH) for secure access to remote servers.

  • Telnet Connections: Telnet for unencrypted communication with remote servers.

  • SCP/SFTP: Secure file transfer protocols used for secure file transfers between systems.

  • Serial Console Access: Provides serial port connections for devices like routers and switches.

Command Line Examples

PuTTY's versatility is partly due to its support for various command-line arguments that allow users to initiate connections with specific parameters directly.

  • SSH Connection connects to hostname as username over SSH on port 22.:

putty.exe -ssh username@hostname -p 22 
  • Telnet Connection initiates a Telnet connection to hostname on port 23:

putty.exe -telnet hostname 23
  • Serial Connection connects to a serial device on COM1 with the specified serial configuration:

putty.exe -serial COM1 -sercfg 9600,8,n,1,X
  • Loading a Saved Session loads a pre-configured session with all its settings:

putty.exe -load "session name"
  • SSH with Key Authentication uses a private key for SSH authentication:

putty.exe -ssh username@hostname -i "C:\Windows\Users\Admin\private_key.ppk"

Common File Paths

  • Configuration Storage: PuTTY does not require installation and stores its configuration data in the Windows Registry under HKEY_CURRENT_USER\Software\SimonTatham\PuTTY.

  • Portable Use: Often found on USB drives for portable applications, with configurations stored within the same directory or the user's profile directory.

  • Log Files: Users can configure PuTTY to save session logs to a specified path, commonly within the user’s document folder or a designated logs directory.

Behavior

  • Session Management: PuTTY allows users to save session configurations for quick access to frequently used connections.

  • Security: Provides robust encryption for data transmitted over network connections, ensuring secure communication.

  • Interoperability: Compatible with a wide range of SSH servers and supports various encryption algorithms and authentication methods.

Previouslsaiso.exeNextX11 Forwarding

Last updated 1 year ago

Was this helpful?