SloppyRAT ClickFix Finger.exe C2 Retrieval
Detects usage of the 'finger' utility via command line within scripts or batch files, or network connections originating from the 'finger' process on port 79 to non-internal destinations. This activity is commonly associated with internal network reconnaissance to gather user information or system details.
Microsoft Sentinel (KQL)
