Windows DNS Queries Triggered by finger.exe

Alerts on Windows DNS queries made by finger.exe, a rarely used utility that can be abused to fetch remote commands.

FreeReviewedSigma · High · v2

Product: windows
Category: dns_query
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-11-19
Updated: 2026-07-31

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags DNS queries where the process image ends with “finger.exe” on Windows. Attackers may abuse the finger protocol to reach out to attacker-controlled infrastructure, including setups where remote commands are retrieved for later execution. The detection relies on Windows DNS query telemetry that includes the initiating process image path.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Windows Network Connection Initiated by finger.exe

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious Doenerium Host Fingerprinting via cmd.exe

Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)

Suspicious Backup Exec Remote Agent Spawning Command Shell via Process Creation (via process_creation)

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

Suspicious ClickFix Command Execution via RunMRU Registry Key

Suspicious LampoRAT Command Dispatcher via Cmd Delayed Expansion Flags (via process_creation)

Windows DNS Queries Triggered by finger.exe

Pivot detection · T1059.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-finger-exe-dns-queries-indicating-potential-c2-command-fetching-c082c2b0

title: Windows DNS Queries Triggered by finger.exe
id: a648674a-3f16-41eb-9084-e9862e9da583
related:
  - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6
    type: similar
  - id: af491bca-e752-4b44-9c86-df5680533dbc
    type: similar
  - id: c082c2b0-525b-4dbc-9a26-a57dc4692074
    type: derived
status: experimental
description: This rule flags DNS queries where the process image ends with “finger.exe” on Windows. Attackers may abuse the finger protocol to reach out to attacker-controlled infrastructure, including setups where remote commands are retrieved for later execution. The detection relies on Windows DNS query telemetry that includes the initiating process image path.
references:
  - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_finger.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-19
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.execution
  - attack.t1059.003
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    Image|endswith: \finger.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL