Sigma rule: Network Connection Initiated via Finger.EXE

Rule

Title

Network Connection Initiated via Finger.EXE

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-19

File

rules/windows/network_connection/net_connection_win_finger.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such network connections can also help identify potential malicious infrastructure used by threat actors

Log source

product

windows

category

network_connection

Detection

selection:
    Initiated: 'true'
    Image|endswith: '\finger.exe'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.command-and-control
• attack.t1071.004
• attack.execution
• attack.t1059.003

MITRE ATT&CK ids this rule names

• T1059.003
• T1071.004

Related rules

• c082c2b0-525b-4dbc-9a26-a57dc4692074 (similar)
• af491bca-e752-4b44-9c86-df5680533dbc (similar)

References

• https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_finger.yml