Finger Execution (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Finger.exe, a command that ships with Windows to retrieve information about users on remote computers running the Finger service or daemon. Communication is carried via the Name/Finger network communication protocol.As this is a common component on Windows, it can be leveraged to perform living-off-the-land attacks

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1105` Ingress Tool Transfer

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '7833.10327'
title: Finger Execution
description: 'Finger.exe, a command that ships with Windows to retrieve information
  about users on remote computers running the Finger service or daemon. Communication
  is carried via the Name/Finger network communication protocol.As this is a common
  component on Windows, it can be leveraged to perform living-off-the-land attacks.
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Software Association:
  MINEBRIDGE -- Atomics T1105 Test #16 '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ("finger.exe" OR
  (".exe" "@"))| table _time, host, user process, process_*, signature_id, parent_*
  | bin span=1s | stats values(*) as * by _time, host | where match(process_name,"(?i)finger")
  OR match(process,"(?i)(finger)|\S+@(.*?\.\w{2,4}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://dmfrsecurity.com/2020/12/31/using-finger-exe-to-transfer-files/
- https://strontic.github.io/xcyclopedia/library/finger.exe-8E9AFA491D704EAF9183B15A189BBDE2.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` EventCode=1 ("finger.exe" OR (".exe" "@"))

Stage 2: `table`

| table _time, host, user process, process_*, signature_id, parent_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `where`

| where match(process_name,"(?i)finger") OR match(process,"(?i)(finger)|\S+@(.*?\.\w{2,4}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process`	regex_match	`"(?i)(finger)` `\S+@(.*?.\w{2,4}\|\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`
`process_name`	regex_match	`"(?i)finger"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"finger.exe"`
1	`".exe"`
1	`"@"`