Finger Execution (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Finger.exe, a command that ships with Windows to retrieve information about users on remote computers running the Finger service or daemon. Communication is carried via the Name/Finger network communication protocol.As this is a common component on Windows, it can be leveraged to perform living-off-the-land attacks

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1105` Ingress Tool Transfer

References

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: '7833.9440'
title: Finger Execution
description: 'Finger.exe, a command that ships with Windows to retrieve information
  about users on remote computers running the Finger service or daemon. Communication
  is carried via the Name/Finger network communication protocol.As this is a common
  component on Windows, it can be leveraged to perform living-off-the-land attacks.
  -- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN) -- Software Association:
  MINEBRIDGE -- Atomics T1105 Test #16 '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("finger.exe" OR (".exe" "@")) | table _time,
  host, user process, process_*, signature_id, parent_* | bin span=1s | stats values(*)
  as * by _time, host | where match(process_name,"(?i)finger") OR match(process,"(?i)(finger)|\S+@(.*?\.\w{2,4}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})") '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows event logs
references:
- https://dmfrsecurity.com/2020/12/31/using-finger-exe-to-transfer-files/
- https://strontic.github.io/xcyclopedia/library/finger.exe-8E9AFA491D704EAF9183B15A189BBDE2.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("finger.exe" OR (".exe" "@"))

Stage 2: `table`

| table _time, host, user process, process_*, signature_id, parent_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `where`

| where match(process_name,"(?i)finger") OR match(process,"(?i)(finger)|\S+@(.*?\.\w{2,4}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`process`	regex_match	`"(?i)(finger)` `\S+@(.*?.\w{2,4}\|\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`
`process_name`	regex_match	`"(?i)finger"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4688<"`
1	`"finger.exe"`
1	`".exe"`
1	`"@"`