Windows Process Creation: finger.exe Execution

Alerts on Windows executions of finger.exe, a legacy utility that may indicate suspicious reconnaissance or network activity.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), omkar72, oscd.community (SigmaHQ), DRL 1.1
Published: 2021-02-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the executed binary is finger.exe (matching OriginalFileName and the image path ending in \finger.exe). finger.exe is a legacy Windows utility and is uncommon in normal operations, so unexpected execution can indicate attacker staging or command-and-control activity. The detection relies on process creation telemetry, including image path and OriginalFileName fields.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

Suspicious File Download to Shared Memory Directory on Linux

Malicious axios NPM Supply Chain C2 Domain Resolution

Suspicious Curl Download From Sysinternals Live Service (via process_creation)

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Malicious Curl MSI Download to ProgramData via Process Creation

Suspicious CloudZ RAT Payload Download via curl to ProgramData

Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage

Windows Process Creation: finger.exe Execution

Pivot detection · T1105 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-finger-exe-execution-af491bca

title: "Windows Process Creation: finger.exe Execution"
id: 22b0b034-f9bc-41df-8bcf-af5224600a37
related:
  - id: c082c2b0-525b-4dbc-9a26-a57dc4692074
    type: similar
  - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6
    type: similar
  - id: af491bca-e752-4b44-9c86-df5680533dbc
    type: derived
status: test
description: This rule flags Windows process creation events where the executed binary is finger.exe (matching OriginalFileName and the image path ending in \finger.exe). finger.exe is a legacy Windows utility and is uncommon in normal operations, so unexpected execution can indicate attacker staging or command-and-control activity. The detection relies on process creation telemetry, including image path and OriginalFileName fields.
references:
  - https://twitter.com/bigmacjpg/status/1349727699863011328?s=12
  - https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/
  - http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_finger_execution.yml
author: Florian Roth (Nextron Systems), omkar72, oscd.community, Huntrule Team
date: 2021-02-24
modified: 2024-06-27
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: finger.exe
    - Image|endswith: \finger.exe
  condition: selection
falsepositives:
  - Admin activity (unclear what they do nowadays with finger.exe)
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL