Sigma rule: DNS Query by Finger Utility

Rule

Title

DNS Query by Finger Utility

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-19

File

rules/windows/dns_query/dns_query_win_finger.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

Log source

product

windows

category

dns_query

Detection

selection:
    Image|endswith: '\finger.exe'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.command-and-control
• attack.t1071.004
• attack.execution
• attack.t1059.003

MITRE ATT&CK ids this rule names

• T1059.003
• T1071.004

Related rules

• 2fdaf50b-9fd5-449f-ba69-f17248119af6 (similar)
• af491bca-e752-4b44-9c86-df5680533dbc (similar)

References

• https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/dns_query/dns_query_win_finger.yml