SECURITY Signal 517
Finger protocol exploited to deliver malware via obfuscated command on Windows
↗
Attackers used the legacy Finger protocol with caret-escaped syntax to download and execute a Python RAT on a Windows host, persisting via a signed interpreter and a registry Run key.
The endpoint detection rule fired thousands of alerts but was set to alert-only, so no containment occurred despite the malicious activity. Because the rule could not distinguish benign Python use from the malicious finger-derived command, the real compromise was lost in noise, showing the need for contextual alert correlation and stricter action policies.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The attack used caret-escaped finger.exe to bypass string-matching detections while leveraging a legitimate Windows binary.
Persistence was achieved by dropping a signed pythonw.exe and a .pyc payload in C:\ProgramData\ and adding a registry Run key.
Detection alerts were abundant but ineffective because they were alert-only and could not differentiate the malicious finger command from normal Python usage.
THE READ
What the cluster adds up to.
The Finger protocol, originally designed in 1977 to report logged-in users, was abused to deliver malware on a Windows system. Attackers obfuscated the binary name with caret characters (f^i^n^g^e^r) so that simple string matching missed the call. The obfuscated finger command queried a hostile host and piped the returned text directly into cmd.exe for execution. This let the attacker run arbitrary commands without using HTTP or other commonly inspected channels.
The endpoint detection rule that flagged suspicious Python execution fired tens of thousands of times but was configured alert-only. Because the rule was alert-only, it generated alerts without taking any containment action on the compromised host. The same rule produced benign alerts on two other machines, creating noise that drowned the genuine compromise. Thus the cost of relying on alert-only policies is missed incidents despite abundant telemetry.
If an environment blocks or monitors finger.exe execution, the initial delivery vector would be stopped. Watching TCP port 79 for unusual finger traffic would also prevent the attacker’s command retrieval. Detection rules that look for caret-escaped binary names or that correlate Python execution with unusual parent processes could catch the obfuscation. Blocking unauthorized writes to C:\ProgramData\ or monitoring registry Run key additions would hinder persistence.
The incident shows that legacy binaries in Windows can be weaponized as living-off-the-land tools when combined with old obfuscation tricks. Security teams should shift from alert-only to alert-and-contain policies and enrich rules with contextual data such as command-line ancestry. Regular review of allowed native binaries and network ports reduces the attack surface that attackers can exploit for stealth. Ultimately, detecting the malicious chain requires linking the rare finger command to the subsequent Python payload rather than treating each alert in isolation.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER