Suspicious Network Connection Initiated through Finger.EXE (via network_connection)

This rule detects network connections via finger.exe, that can be misused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, threat actors leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not frequently used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential hostile infrastructure used by threat actors