Suspicious Finger.exe Execution via Scripting Host
Detects the execution of the 'finger.exe' utility when initiated by common scripting hosts or command shells. The 'finger' utility is an antiquated network protocol often used by adversaries for network information or user enumeration. Its execution from within script interpreters is highly atypical and likely indicates malicious reconnaissance activity.
Microsoft Sentinel (KQL)
