Linux: Network connections initiated to LocaltoNet tunneling subdomains

Alerts when a Linux host initiates outbound connections to LocaltoNet (.localto.net/.localtonet.com) tunneling subdomains.

FreeReviewedSigma · High · v3

Product: linux
Category: network_connection
Author: Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
Published: 2024-06-17
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executables on Linux that initiate outbound network connections to LocaltoNet tunneling subdomains ending in .localto.net or .localtonet.com. Use of these reverse-proxy style tunnels can allow internal localhost services to be exposed externally, which attackers may abuse for command-and-control to bypass local access controls. Detection relies on network connection telemetry that records the destination hostname and whether the connection was initiated.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains

Windows: Detect cloudflared tunnel cleanup command execution

Windows Process Creation: cloudflared Tunnel Execution with Config and Credentials Flags

Linux network connections to ngrok tunneling endpoints

Windows Executable Initiating Connections to ngrok Tunnel Domains

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Linux: Network connections initiated to LocaltoNet tunneling subdomains

Pivot detection · T1572 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-network-connections-to-localtonet-tunneling-subdomains-c4568f5d

title: "Linux: Network connections initiated to LocaltoNet tunneling subdomains"
id: 5d466cda-fd92-4430-bdc4-bf49b5567c60
status: test
description: This rule flags executables on Linux that initiate outbound network connections to LocaltoNet tunneling subdomains ending in .localto.net or .localtonet.com. Use of these reverse-proxy style tunnels can allow internal localhost services to be exposed externally, which attackers may abuse for command-and-control to bypass local access controls. Detection relies on network connection telemetry that records the destination hostname and whether the connection was initiated.
references:
  - https://localtonet.com/documents/supported-tunnels
  - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-06-17
tags:
  - attack.command-and-control
  - attack.t1572
  - attack.t1090
  - attack.t1102
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationHostname|endswith:
      - .localto.net
      - .localtonet.com
    Initiated: "true"
  condition: selection
falsepositives:
  - Legitimate use of the LocaltoNet service.
level: high
license: DRL-1.1
related:
  - id: c4568f5d-131f-4e78-83d4-45b2da0ec4f1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL