Finger protocol abuse and Python RAT delivery expose alert-only gaps

At a glance

What this is: Artemis Security describes a Windows compromise in which an obfuscated finger command delivered a Python RAT while alert-only endpoint detections fired but never stopped execution.

Why it matters: This matters because identity and endpoint teams need controls that contain risky execution paths, not just log them, especially when legitimate binaries and persistence overlap with NHI-like script delivery patterns.

Context

Finger protocol abuse is a delivery technique, not a novelty protocol story. The security gap is that defenders still encounter old, low-visibility command channels on modern Windows endpoints, where signed binaries, script interpreters and writable staging paths can be chained into a working implant without tripping a simple block.

In this case, the relevance for IAM and NHI practitioners is indirect but real. The attack used a signed interpreter, persistence through a Run key, and script-based payload execution, which mirrors the governance problem of distinguishing legitimate automation from hostile execution using the same operating patterns.

Alert-only detection is the central control failure here. If a rule can fire repeatedly but cannot contain, correlate or escalate the event into action, it becomes telemetry rather than defense; that is a programme design problem, not a tuning problem.

Key questions

Q: What breaks when finger.exe is allowed on workstations?

A: It creates a low-friction command delivery path that many environments never watch closely. On a workstation, finger.exe can be abused to fetch and execute attacker commands, so the control failure is not the protocol itself but the absence of an endpoint policy that treats it as suspicious by default.

Q: Why do alert-only endpoint detections fail against RAT persistence?

A: Because a truthful alert still leaves the compromise in place if nothing interrupts execution, blocks re-launch, or isolates the host. When persistence is already written, the attacker only needs the next login or process start to recover the foothold, so detection without response becomes operational noise.

Q: What are the signs that Python-based malware is running from trusted Windows paths?

A: Look for pythonw.exe or python.exe starting from C:\ProgramData\, launched by cmd or PowerShell, writing Run keys, and spawning background payloads with little user-visible activity. A signed interpreter is not reassuring if the ancestry, location and persistence pattern fit a staged compromise.

Q: When should defenders contain a host instead of just triaging alerts?

A: Containment should happen when repeated behavioural alerts line up with suspicious process ancestry, writable staging paths and persistence, even if each individual event looks plausible. If the same rule is noisy on other hosts, use correlation to isolate the one host that shows the full chain rather than waiting for manual certainty.

Technical breakdown

How finger.exe becomes a malware delivery channel

Finger is an old TCP service that returns text output, which makes it surprisingly easy to abuse as a command transport when the client is still present on the host. Attackers can point finger.exe at a remote responder, strip protocol headers with shell parsing, and treat the returned lines as executable commands. Because the binary is signed and native to Windows, basic allow-listing often leaves it untouched. Obfuscation such as caret insertion further reduces literal-string detection value, especially when defenders match only the surface command line and not the parsed command.

Practical implication: Block or alert on finger.exe on endpoints and detect command parsing patterns that execute remote text as shell instructions.

Why signed Python and .pyc payloads still hide malicious execution

The malicious logic often lives in the compiled .pyc payload, not in the Python interpreter itself. That means the interpreter can be validly signed and still run attacker-controlled code from C:\ProgramData\ or another writable path. pythonw.exe makes the process quieter by running without a console, while cmd /c start /b keeps the execution backgrounded. This is a classic living-off-the-land pattern: trusted runtime, untrusted content, and a staging location that looks operational rather than obviously malicious.

Practical implication: Treat interpreter provenance and payload location as first-class signals, not the binary signature alone.

Why alert-only endpoint rules fail against multi-stage persistence

Alert-only means the control records an event but does not interrupt the process chain. In a multi-stage compromise, that creates a gap between detection and containment that attackers can exploit to write registry persistence, relaunch on login, and drop second-stage code. The problem is compounded when the same rule fires on benign developer activity, because the true malicious host becomes one true event buried in thousands of false positives. At that point, the rule is generating workload, not defence.

Practical implication: Convert high-confidence behavioural detections into containment-capable playbooks or they will remain operationally unusable.

Threat narrative

Attacker objective: The attacker’s objective was persistent remote execution on the workstation with enough stealth to survive logins and keep the RAT active under noisy detection.

1. Entry occurred through an obfuscated finger command that contacted a remote host and executed returned text inline on the Windows endpoint.
2. Credential or execution abuse followed when the chain launched a signed Python interpreter and ran a compiled .pyc payload from C:\ProgramData\.
3. Escalation of persistence came from a registry Run key that re-launched the payload at each login and a second-stage PowerShell drop.
4. Impact was sustained remote-access trojan activity on the workstation while the endpoint agent alerted but never contained the compromise.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Alert-only telemetry is not a control, it is an observation layer. This case shows why detection programmes fail when they cannot change the state of the endpoint. The endpoint agent produced true alerts, but the host remained compromised because no containment path was attached to the behaviour. That is a governance failure in the detection-to-response handoff, and it should be treated as such by security leaders.

Finger protocol abuse creates a detection blind spot because the delivery mechanism looks like legacy administration noise. The protocol is old, uncommon and easy to obfuscate, which means defenders cannot rely on frequency or reputation alone. The named concept here is alert-to-action gap: the interval between a truthful detection and a meaningful response, during which persistence and second-stage execution continue unchecked. Practitioners should regard that gap as a measurable operational risk.

Signed binaries do not equal safe execution. The important question is where the interpreter runs from, what launched it, and what payload it executes. This matters for identity governance as well, because many environments still treat trusted runtime components as inherently legitimate when the real control boundary is the combination of origin, context and delegated execution rights. The practitioner conclusion is to govern runtime trust, not just binary trust.

Noise-aware correlation is now a core defensive requirement. A single behavioural rule can be technically correct and operationally useless if it fires across both benign and malicious hosts without context. The article illustrates why endpoint governance has to include correlation logic, response authority and escalation criteria, not only detection logic. The field needs to stop measuring alert volume and start measuring decision quality.

Modern endpoint compromise increasingly resembles identity misuse, not pure malware execution. The chain depended on a legitimate interpreter, writable staging paths, persistence registration and repeated login-based re-execution. That is a control problem about who or what is allowed to execute, persist and re-enter the environment under trusted context. The practical lesson is that endpoint security, NHI governance and execution policy are converging.

What this signals

alert-to-action gap: this case shows that the real failure is not whether telemetry exists, but whether the organisation can convert repeated alerts into containment before the payload re-executes. Endpoint programmes should measure how long a high-confidence alert can remain unresolved, because that interval is where persistence succeeds.

Modern endpoint compromise now frequently blends legitimate runtimes, writable paths and background execution in ways that look like normal administration until the ancestry is reconstructed. The operational lesson is to move beyond per-event severity and build correlation that ties parent process, staging location and persistence into one decision.

For NHI and identity leaders, the interesting parallel is governance of delegated execution. A trusted interpreter running attacker-supplied code from a writable directory is the same control problem as overbroad machine authority: the system is allowed to act in contexts it should never have been given.

For practitioners

• Hunt for finger.exe on endpoints Alert on any execution of finger.exe on workstations, and treat command lines containing @ or caret-obfuscated finger strings as high-signal delivery activity.
• Correlate interpreter launches with staging paths Flag pythonw.exe, python.exe and similar interpreters when they start from C:\ProgramData\, C:\Users\Public\ or %TEMP% and are parented by cmd.exe, PowerShell or a parsing loop.
• Promote behavioural detections out of alert-only mode Require a containment or triage path for rules that detect repeated suspicious execution, especially when the same rule also fires on developer tooling or installers.
• Watch for login-based persistence chains Review Run keys, startup entries and scheduled tasks that point to script interpreters or .pyc payloads, particularly when they are written near the first execution event.
• Separate benign automation from hostile reuse Build correlation around parent process, writable location, network destination and re-execution timing so legitimate Python usage does not mask malicious script delivery.

Key takeaways

• Finger protocol abuse matters because it can still deliver commands into modern Windows execution chains, especially when the client is present by default.
• The compromise succeeded because a signed interpreter, a writable staging path and registry persistence were enough to keep the RAT alive across logins.
• Alert-only detections created visibility without containment, which meant the attacker retained the foothold until a human reconstructed the chain.

Key terms

• Alert-to-action gap: The time and governance distance between a detection firing and a real containment decision. It is not just a speed metric. It reflects whether security operations can turn a true alert into isolation, triage, or escalation before the attacker completes persistence, staging, or exfiltration.
• Living Off The Land Binary: A Living Off The Land Binary is a legitimate operating system or application executable that attackers abuse to carry out malicious actions. These binaries already exist on the target system, so security tools may trust them by default. They can be used for execution, persistence, defense evasion, credential access, or lateral movement.
• Registry Run Key Persistence: Registry Run Key Persistence is a Windows persistence technique where malware or an unauthorized program adds itself to registry locations that launch automatically at logon or startup. Technically, attackers modify keys such as Run or RunOnce so code executes when a user signs in, helping the threat survive reboots and maintain access.
• World-Writable Staging Path: A world-writable staging path is a directory that ordinary users or processes can write to, such as ProgramData or Public. Attackers use these paths because they blend into normal software behaviour while letting them drop scripts, compiled payloads and second-stage modules for later execution.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore how the course helps teams build governance for machine identities, delegated execution and secrets management.