Query: Sigma rule for Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for exe
Matching passage: Sigma rule: Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for exe. Logsource: windows / dns_query. Rule: title: DNS Query by Finger Utility id: c082c2b0-525b-4dbc-9a26-a57dc4692074 related: - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6 type: similar - id: af491bca-e752-4b44-9c86-df5680533dbc type: similar status: experimental description: 'Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication. ' references: - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.command-and-control - attack.t1071.004 - attack.execution - attack.t1059.003 logsource: product: windows category: dns_query detection: selection: Image|endswith: \finger.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate. Logsource: windows / file_event. Rule: title: EVTX Created In Uncommon Location id: 65236ec7-ace0-4f0c-82fd-737b04fd4dcb status: test description: 'Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting. ' references: - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key author: D3F7A5105 date: 2023-01-02 modified: 2024-03-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: file_event product: windows definition: 'Requirements: The ".evtx" extension should be monitored via a Sysmon configuration. Example: <TargetFilename condition="end with">.evtx<TargetFilename>' detection: selection: TargetFilename|endswith: .evtx filter_main_path: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ filter_main_baseimage: TargetFilename|startswith: C:\ProgramData\Microsoft\Windows\Containers\BaseImages\ TargetFilename|endswith: \Windows\System32\winevt\Logs\ condition: selection and not 1 of filter_main_* falsepositives: - Administrator or backup activity - An unknown bug seems to trigger the Windows "svchost" process to drop EVTX files in the "C:\Windows\Temp" directory in the form "<log_name">_<uuid>.evtx". See https://superuser.com/questions/1371229/low-disk-space-after-filling-up-c-windows-temp-with-evtx-and-txt-files level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_create_evtx_non_common_locations/info.yml