Huntress analysts identified novel use of finger.exe for data exfiltration, documented it internally, and then used that intelligence to accelerate detection on the next incident. Here's how it played out.