Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains
Alerts on initiated outbound connections from Windows hosts to LocaltoNet/.localtonet.com tunneling domains.
- Product
- windows
- Category
- network_connection
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2024-06-17
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows processes that initiate network connections to LocaltoNet or Localtonet subdomains over tunneling services. Such connections can enable exposure of local services and are relevant to attacker command-and-control strategies and attempts to bypass existing access controls. The detection relies on network connection events with the destination hostname ending in the specified tunneling domains and an initiated-connection indicator.
Reporting behind it
- localtonet.comhttps://localtonet.com/documents/supported-tunnels
- cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Network Connections to LocaltoNet/Localtonet Tunneling Subdomains
id: c9296485-608d-44cf-822c-c56aa6eba595
status: test
description: This rule flags Windows processes that initiate network connections to LocaltoNet or Localtonet subdomains over tunneling services. Such connections can enable exposure of local services and are relevant to attacker command-and-control strategies and attempts to bypass existing access controls. The detection relies on network connection events with the destination hostname ending in the specified tunneling domains and an initiated-connection indicator.
references:
- https://localtonet.com/documents/supported-tunnels
- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2024-06-17
tags:
- attack.command-and-control
- attack.t1572
- attack.t1090
- attack.t1102
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|endswith:
- .localto.net
- .localtonet.com
Initiated: "true"
condition: selection
falsepositives:
- Legitimate use of the LocaltoNet service.
level: high
license: DRL-1.1
related:
- id: 3ab65069-d82a-4d44-a759-466661a082d1
type: derived