Linux: Network connections initiated to LocaltoNet tunneling subdomains
Alerts when a Linux host initiates outbound connections to LocaltoNet (.localto.net/.localtonet.com) tunneling subdomains.
- Product
- linux
- Category
- network_connection
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2024-06-17
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags executables on Linux that initiate outbound network connections to LocaltoNet tunneling subdomains ending in .localto.net or .localtonet.com. Use of these reverse-proxy style tunnels can allow internal localhost services to be exposed externally, which attackers may abuse for command-and-control to bypass local access controls. Detection relies on network connection telemetry that records the destination hostname and whether the connection was initiated.
Reporting behind it
- localtonet.comhttps://localtonet.com/documents/supported-tunnels
- cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Network connections initiated to LocaltoNet tunneling subdomains"
id: 5d466cda-fd92-4430-bdc4-bf49b5567c60
status: test
description: This rule flags executables on Linux that initiate outbound network connections to LocaltoNet tunneling subdomains ending in .localto.net or .localtonet.com. Use of these reverse-proxy style tunnels can allow internal localhost services to be exposed externally, which attackers may abuse for command-and-control to bypass local access controls. Detection relies on network connection telemetry that records the destination hostname and whether the connection was initiated.
references:
- https://localtonet.com/documents/supported-tunnels
- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-06-17
tags:
- attack.command-and-control
- attack.t1572
- attack.t1090
- attack.t1102
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationHostname|endswith:
- .localto.net
- .localtonet.com
Initiated: "true"
condition: selection
falsepositives:
- Legitimate use of the LocaltoNet service.
level: high
license: DRL-1.1
related:
- id: c4568f5d-131f-4e78-83d4-45b2da0ec4f1
type: derived