Detects when the finger.exe utility is spawned with a command line containing an @ character, indicating a remote host/server was specified. Finger is a legacy protocol client that has largely fallen out of use and is commonly abused as a living-off-the-land binary (LOLBIN) to fetch encoded payloads or establish covert C2 channels with an attacker-controlled finger server. The analytic searches endpoint process events for finger.exe (by process_name or original_file_name) and requires a command line containing @ to flag potential remote connections. Results are aggregated by process details and parent-child relationships to provide context about which process invoked finger.exe and the remote destination. The rule is designed for telemetry from EDR agents and relies on Splunk CIM-normalized endpoint process data to minimize false positives while highlighting suspicious remote-connect behavior.