Windows finger.exe DNS Queries Indicating Potential C2 Command Fetching

Alerts on Windows DNS queries made by finger.exe, a rarely used utility that can be abused to fetch remote commands.

FreeUnreviewedSigmahighv1

windows-finger-exe-dns-queries-indicating-potential-c2-command-fetching-c082c2b0

title: Windows finger.exe DNS Queries Indicating Potential C2 Command Fetching
id: a648674a-3f16-41eb-9084-e9862e9da583
related:
  - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6
    type: similar
  - id: af491bca-e752-4b44-9c86-df5680533dbc
    type: similar
  - id: c082c2b0-525b-4dbc-9a26-a57dc4692074
    type: derived
status: experimental
description: This rule flags DNS query activity on Windows where the process image ends with \finger.exe. Attackers can abuse the finger protocol/utility to contact remote systems and obtain commands for execution, making this unusual DNS traffic relevant for investigation. Telemetry relies on Windows DNS query events that include the querying process image path.
references:
  - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_finger.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-19
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.execution
  - attack.t1059.003
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    Image|endswith: \finger.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags DNS query activity on Windows where the process image ends with \finger.exe. Attackers can abuse the finger protocol/utility to contact remote systems and obtain commands for execution, making this unusual DNS traffic relevant for investigation. Telemetry relies on Windows DNS query events that include the querying process image path.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.