Suspicious finger.exe outbound TCP/79 connection (ClickFix/SloppyRAT)

Ibrahim Saud@tektrix

•updated Sep 19, 2026•2•0•2

This rule detects two suspicious indicators related to SloppyRAT activity: an outbound network connection using the legacy Finger protocol (TCP port 79), which can be abused by binaries like 'finger.exe' for payload staging, and DNS queries resolving to the known SloppyRAT staging domain 'finger.linked4x.com'.