Finger LoLBin Remote Command Pipe
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key LoLBin technique used in the CrashFix campaign.
Microsoft Sentinel (KQL)
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key LoLBin technique used in the CrashFix campaign.
Already have an account?