Windows Finger.exe Connecting to a Remote Host — Detection Rule
The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified. The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server. This behavior is uncommon in legitimate enterprise usage and warrants investigation.