Possible DNS Query by Finger Utility (via dns_query)

This rule detects DNS queries made by the finger utility, that can be misused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, threat actors leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not frequently used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential hostile infrastructure used by threat actors for command and control (C2) communication.