ClickFix Finger Fetching PowerShell Payload

Daniel Jeremiah@daniyyell

•updated Feb 13, 2026•1•0•39

This rule detects the execution of 'finger.exe' with a command line containing an '@' symbol, which is indicative of ClickFix campaigns fetching obfuscated PowerShell payloads. Legitimate use of 'finger.exe' is rare on Windows, making this a high-fidelity detection for ClickFix delivery.