finger.exe Pipe To Command Shell

Tim Peck@timpeck

•updated Jan 20, 2026•7•0•17,485

Detects the use of the finger.exe utility to download remote data and pipe it directly into a command interpreter for execution. This LOLBin technique is used by threat actors like KongTuke to download and execute subsequent stages.