Linux Network Connections to LocaltoNet Tunneling Subdomains

Alerts when a Linux host initiates outbound connections to LocaltoNet (.localto.net/.localtonet.com) tunneling subdomains.

FreeUnreviewedSigmahighv1

linux-network-connections-to-localtonet-tunneling-subdomains-c4568f5d

title: Linux Network Connections to LocaltoNet Tunneling Subdomains
id: 5d466cda-fd92-4430-bdc4-bf49b5567c60
status: test
description: This rule flags network connections initiated from an executable to destination hostnames ending in .localto.net or .localtonet.com. LocaltoNet is a reverse proxy used to expose localhost services externally, so unexpected tunnel initiation can indicate outbound command-and-control or proxying. The detection relies on network connection telemetry with destination hostname suffixes and connection initiation events.
references:
  - https://localtonet.com/documents/supported-tunnels
  - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-06-17
tags:
  - attack.command-and-control
  - attack.t1572
  - attack.t1090
  - attack.t1102
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationHostname|endswith:
      - .localto.net
      - .localtonet.com
    Initiated: "true"
  condition: selection
falsepositives:
  - Legitimate use of the LocaltoNet service.
level: high
license: DRL-1.1
related:
  - id: c4568f5d-131f-4e78-83d4-45b2da0ec4f1
    type: derived

What it detects

This rule flags network connections initiated from an executable to destination hostnames ending in .localto.net or .localtonet.com. LocaltoNet is a reverse proxy used to expose localhost services externally, so unexpected tunnel initiation can indicate outbound command-and-control or proxying. The detection relies on network connection telemetry with destination hostname suffixes and connection initiation events.

Known false positives

Legitimate use of the LocaltoNet service.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.