Windows DNS Queries Triggered by finger.exe

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags DNS queries where the process image ends with “finger.exe” on Windows. Attackers may abuse the finger protocol to reach out to attacker-controlled infrastructure, including setups where remote commands are retrieved for later execution. The detection relies on Windows DNS query telemetry that includes the initiating process image path.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Windows Network Connection Initiated by finger.exe

Suspicious Script Download via Curl and PowerShell by Dohdoor

Suspicious IP Release and Renew via Minimized cmd During Driver Install

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Malicious Metasploit Reverse Shell Injection in SQL Server (via process_creation)

Suspicious Fake Crypto Wallet Installer Batch Script Staging (via file_event)

Obfuscated Encoded PowerShell Payload Deployed via Process Execution (via process_creation)

DoT (DNS Over TLS) Activation - Command (via process_creation)

Operator Bloopers Cobalt Strike Modules

Windows DNS Queries Triggered by finger.exe

Pivot detection · T1059.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-finger-exe-dns-queries-indicating-potential-c2-command-fetching-c082c2b0

title: Windows DNS Queries Triggered by finger.exe
id: a648674a-3f16-41eb-9084-e9862e9da583
related:
  - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6
    type: similar
  - id: af491bca-e752-4b44-9c86-df5680533dbc
    type: similar
  - id: c082c2b0-525b-4dbc-9a26-a57dc4692074
    type: derived
status: experimental
description: This rule flags DNS queries where the process image ends with “finger.exe” on Windows. Attackers may abuse the finger protocol to reach out to attacker-controlled infrastructure, including setups where remote commands are retrieved for later execution. The detection relies on Windows DNS query telemetry that includes the initiating process image path.
references:
  - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_finger.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-19
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.execution
  - attack.t1059.003
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    Image|endswith: \finger.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL