DNS Query by Finger Utility

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

2025-11-19 00:00:00

None

c082c2b0-525b-4dbc-9a26-a57dc4692074

attack.command-and-control attack.t1071.004 attack.execution attack.t1059.003

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5763 from @swachchhanda000 - Update ClickFix/FileFix related rules

2025-11-28