Finger.EXE Execution
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
Finger.EXE Execution | Standard | Windows | Command and Control: Ingress Tool Transfer (T1105) | Trouble |
About the rule
Rule Type
Standard
Rule Description
Finger.exe is a legacy Windows command-line utility originally designed to retrieve user information from remote systems using the Finger protocol. While rarely used in modern enterprise environments, attackers may abuse finger.exe to perform reconnaissance, enumerate users, or even exfiltrate data by communicating with malicious remote servers.
Severity
Trouble
Rule journey
Attack chain scenario
Initial access → Execution → Reconnaissance/Abuse of finger.exe → Impact
Impact
- Reconnaissance and enumeration
- User and host information disclosure
- Command and control communication
- Data exfiltration
- Defense evasion
Rule Requirement
Prerequisites
Use the Group Policy Management Console to audit process creation and process termination.
Install Sysmon from Microsoft Sysinternals and download the Sysmon configuration file that includes process creation monitoring. Add network connection events to the configuration file to monitor all network activity.
Create a new registry key "Microsoft-Windows-Sysmon/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\" if not already created.
Criteria
Action1: actionname = "Process started" AND ORIGINALFILENAME = "finger.exe" OR PROCESSNAME endswith "\finger.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Command and Control: Ingress Tool Transfer (T1105)
Security Standards
Enabling this rule will help you meet the security standard's requirement listed below:
DE.CM-01: Networks and network services are monitored to find potentially adverse events.
When this rule is triggered, you’re notified of the execution of finger.exe, especially with unusual or externally facing command-line arguments. This enables you to review process usage, analyze the context of finger.exe invocations, and quickly identify unauthorized or suspicious use of the utility. Such monitoring strengthens your organization’s defense posture and enables rapid detection and investigation of potential external reconnaissance or data leakage attempts.
Author
Florian Roth (Nextron Systems), omkar72, oscd.community
Future actions
Known False Positives
This rule may trigger during legitimate use of finger.exe in rare, sanctioned troubleshooting or administrative scenarios. Review command-line arguments, the destination server, and the initiating user or service to determine legitimacy.
Next Steps
When this rule is triggered, the following measures can be implemented:
- Identification: Identify if the flagged event is a new incident or part of an existing incident.
- Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
- Response: Respond promptly by initiating an automated workflow to interrupt the network connections and cease the malicious process.
- Reconfiguration: Update allowlists and detection rules to reflect any confirmed legitimate use, and continue monitoring for anomalous executions of finger.exe in the environment.
Mitigation
Mitigation ID | Mitigation Name | Mitigation description |
M1031 | Network Intrusion Prevention | Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.(Citation: University of Birmingham C2) |
