Windows Network Connection via Finger.EXE

Alerts on Windows network connections started by finger.exe, an unusual utility that can support remote command retrieval.

FreeUnreviewedSigmahighv1

windows-network-connection-via-finger-exe-2fdaf50b

title: Windows Network Connection via Finger.EXE
id: de23b6fd-12c7-4b36-8605-d6e64ceb8cbd
related:
  - id: c082c2b0-525b-4dbc-9a26-a57dc4692074
    type: similar
  - id: af491bca-e752-4b44-9c86-df5680533dbc
    type: similar
  - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6
    type: derived
status: experimental
description: This rule flags outbound network connections initiated by finger.exe on Windows endpoints. Because finger.exe is uncommon in modern environments, its use over the network can indicate attacker-controlled command retrieval or other remote interaction. The detection relies on network-connection events that include process initiation status and the executable path ending in \finger.exe.
references:
  - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_finger.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-19
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.execution
  - attack.t1059.003
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    Image|endswith: \finger.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags outbound network connections initiated by finger.exe on Windows endpoints. Because finger.exe is uncommon in modern environments, its use over the network can indicate attacker-controlled command retrieval or other remote interaction. The detection relies on network-connection events that include process initiation status and the executable path ending in \finger.exe.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.