DNS Query by Finger Utility
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
Severity
Attention
Rule Requirement
Criteria
Action1:
actionname = "DNS Query Executed" AND (PROCESSNAME endswith "\finger.exe")
select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.QUERY,Action1.STATUSCODE,Action1.RESULT
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@Swachchhanda Shrawan Poudel (Nextron Systems)
