Windows Process Creation: finger.exe Execution

Alerts on Windows executions of finger.exe, a legacy utility that may indicate suspicious reconnaissance or network activity.

FreeUnreviewedSigmahighv1

windows-process-creation-finger-exe-execution-af491bca

title: "Windows Process Creation: finger.exe Execution"
id: 22b0b034-f9bc-41df-8bcf-af5224600a37
related:
  - id: c082c2b0-525b-4dbc-9a26-a57dc4692074
    type: similar
  - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6
    type: similar
  - id: af491bca-e752-4b44-9c86-df5680533dbc
    type: derived
status: test
description: This rule flags process creation events where the executed binary is finger.exe, identified by OriginalFileName equal to finger.exe or the process image path ending with \\finger.exe. Attackers may use this legacy utility for reconnaissance or network-related activity, and its presence is relatively uncommon in typical enterprise workflows. The detection relies on Windows process creation telemetry containing the executable filename and/or image path.
references:
  - https://twitter.com/bigmacjpg/status/1349727699863011328?s=12
  - https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/
  - http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_finger_execution.yml
author: Florian Roth (Nextron Systems), omkar72, oscd.community, Huntrule Team
date: 2021-02-24
modified: 2024-06-27
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: finger.exe
    - Image|endswith: \finger.exe
  condition: selection
falsepositives:
  - Admin activity (unclear what they do nowadays with finger.exe)
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/info.yml
license: DRL-1.1

What it detects

This rule flags process creation events where the executed binary is finger.exe, identified by OriginalFileName equal to finger.exe or the process image path ending with \\finger.exe. Attackers may use this legacy utility for reconnaissance or network-related activity, and its presence is relatively uncommon in typical enterprise workflows. The detection relies on Windows process creation telemetry containing the executable filename and/or image path.

Known false positives

Admin activity (unclear what they do nowadays with finger.exe)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.