Communication To LocaltoNet Tunneling Service Initiated - Linux

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•23

This rule detects network connections initiated by an executable to sub-domains associated with the "LocaltoNet" tunneling service. LocaltoNet is a reverse proxy that exposes localhost services to the internet. Adversaries have been observed leveraging this service for command-and-control (C2) activities, often to bypass multi-factor authentication (MFA) and perimeter security controls.