Can’t Touch This: Data Exfiltration via Finger

Huntress observed threat actors leveraging the native Windows finger.exe utility to download files and exfiltrate unencrypted data from a compromised MS Exchange server (example commands and an associated malicious IP 185.56.83.82 are provided); the report maps the activity to MITRE ATT&CK techniques (T1105, T1048.003) and recommends monitoring or removing unused LOLBins and tuning detection to identify such abuse.