SloppyRAT ClickFix: finger.exe or curl.exe Staged from cmd/PowerShell

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects the execution of network utilities like finger.exe or curl.exe (with download parameters) initiated by a command shell (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used by adversaries for reconnaissance or downloading malicious payloads.