Windows Lolbin Finger Abuse For Execution
Detects the abuse of the Windows 'finger.exe' utility to download and execute commands, a technique observed in the CrashFix campaign. The rule looks for finger.exe (or its renamed variant 'ct.exe') piping output to cmd.exe.
YARA-L
