Windows Network Connections to LocaltoNet Tunneling Subdomains Initiated

Alerts on initiated outbound connections from Windows hosts to LocaltoNet/.localtonet.com tunneling domains.

FreeUnreviewedSigmahighv1

windows-network-connections-to-localtonet-tunneling-subdomains-initiated-3ab65069

title: Windows Network Connections to LocaltoNet Tunneling Subdomains Initiated
id: c9296485-608d-44cf-822c-c56aa6eba595
status: test
description: This rule flags a process initiating a network connection with the Initiated flag set to true where the destination hostname ends with .localto.net or .localtonet.com. LocaltoNet is a reverse-proxy tunneling service that can expose local services externally, making it useful for attacker-controlled access. The detection relies on Windows network connection telemetry, specifically the destination hostname suffix and connection initiation status.
references:
  - https://localtonet.com/documents/supported-tunnels
  - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-06-17
tags:
  - attack.command-and-control
  - attack.t1572
  - attack.t1090
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|endswith:
      - .localto.net
      - .localtonet.com
    Initiated: "true"
  condition: selection
falsepositives:
  - Legitimate use of the LocaltoNet service.
level: high
license: DRL-1.1
related:
  - id: 3ab65069-d82a-4d44-a759-466661a082d1
    type: derived

What it detects

This rule flags a process initiating a network connection with the Initiated flag set to true where the destination hostname ends with .localto.net or .localtonet.com. LocaltoNet is a reverse-proxy tunneling service that can expose local services externally, making it useful for attacker-controlled access. The detection relies on Windows network connection telemetry, specifically the destination hostname suffix and connection initiation status.

Known false positives

Legitimate use of the LocaltoNet service.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.