Finger.EXE Execution

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule finger_exe_execution {

  meta:
    author = "Florian Roth (Nextron Systems), omkar72, oscd.community"
    description = "Detects execution of the finger.exe utility. Finger.EXE or \"TCPIP Finger Command\" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of finger.exe can be considered suspicious and worth investigating."
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_finger_execution.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Finger.EXE Execution"
    sigma_uuid = "af491bca-e752-4b44-9c86-df5680533dbc"
    sigma_status = "test"
    rule_id = "mr_9174795b-96f3-4fce-b5a3-f8e5901990b1"
    tactic = "TA0011"
    technique = "T1105"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Admin activity (unclear what they do nowadays with finger.exe)"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    (
        $process.src.process.file.full_path = "finger.exe" nocase or
        re.regex($process.target.process.file.full_path, `\\finger\.exe$`) nocase
    )
    $process.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
      //example usage of specifying test user and hostname to adjust risk score
      $risk_score = max(if($process.principal.user.userid = "user" and $process.principal.hostname = "hostname", 0, 15))
      $principal_process_pid = array_distinct($process.principal.process.pid)
      $principal_process_command_line = array_distinct($process.principal.process.command_line)
      $principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
      $principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
      $principal_process_product_specfic_process_id = array_distinct($process.principal.process.product_specific_process_id)
      $principal_process_parent_process_product_specfic_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
      $target_process_pid = array_distinct($process.target.process.pid)
      $target_process_command_line = array_distinct($process.target.process.command_line)
      $target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
      $target_process_file_full_path = array_distinct($process.target.process.file.full_path)
      $target_process_product_specfic_process_id = array_distinct($process.target.process.product_specific_process_id)
      $principal_user_userid = array_distinct($process.principal.user.userid)
      $log_type = array_distinct(strings.concat($process.metadata.log_type,"/",$process.metadata.product_event_type))

  condition:
    $process
}