Communication To LocaltoNet Tunneling Service Initiated
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
Communication To LocaltoNet Tunneling Service Initiated | Standard | Windows | Command and Control: Protocol Tunneling (T1572), Command and Control: Proxy (T1090), Command and Control: Web Service (T1102) | Trouble |
About the rule
Rule Type
Standard
Rule Description
An executable process within an internal network initiate a communication with LocaltoNet tunneling services exposing local systems and applications through tunnels to internet and this gateway can exploit command and control services to bypass MFA and other perimeter controls.
Severity
Trouble
Rule journey
Attack chain scenario
Initial access (Through network endpoint) → Execution (Setup Tunnel) → Defense Evasion → Command and control → Impact
Impact
- The attacker accesses the exposed internal resource remotely, often for lateral movement, data exfiltration, or maintaining persistent access.
- C2 or domain traffic is tunneled through the LocaltoNet service, masking the true destination of the attacker's infrastructure and bypassing security monitoring.
- Data exfiltration
Rule Requirement
Prerequisites
- Download and install Sysmon from Microsoft Sysinternals. Then, open a Command prompt with administrator privileges and create a Sysmon configuration which monitors the network connection using -
sysmon.exe -i [configfile.xml].
- Add network connection events to monitor in your configuration file using -
<Sysmon>
<EventFiltering>
<NetworkConnect onmatch="exclude"/>
<!-- This captures all network connection events -->
</EventFiltering>
</Sysmon>
- Create a new registry key "Microsoft-Windows-Sysmon/Network" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".
- Allocate the registry value of Max Size to 200MB to ensure adequate storage for network logs, as they tend to be high volume.
Criteria
Action1: actionname = "sa_network_connection" AND DESTINATIONHOST endswith ".localto.net,.localtonet.com" AND IS_INITIATED = "true" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Command and Control: Protocol Tunneling (T1572), Command and Control: Proxy (T1090), Command and Control: Web Service (T1102)
Security Standards
Enabling this rule will help you meet the security standard's requirement listed below:
DE.CM-01: Networks and network services are monitored to find potentially adverse events.
Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools and identify the unusual behavior during the connection initiated to LocalToNet tunneling services. Enforce the policies on the web traffic to ensure the network security.
PR.IR-01: Networks and environments are protected from unauthorized logical access and usage.
This security standard essentially emphasizes on protecting the network and environments from accessing any illegitimate traffic or usage. Role based access controls and network segmentation techniques are implemented.
Author
Andreas Braathen (mnemonic.io)
Future actions
Known False Positives
Sanctioned business tools or applications trigger a few scripts to initiate connection to LocalToNet tunneling services for certain operational activities such as automated backups, remote access for vendors or managed cloud services.
Next Steps
When this rule is triggered, the following measures can be implemented:
- Identification: Identify the event and check if the flagged incident is new or the existing one.
- Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
- Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
- Reconfiguration: Update the network policies and port configurations and continuously monitor traffic trends in the network.
Mitigation
Mitigation ID | Mitigation Name | Mitigation description |
M1031 | The mitigation tactic ensures to utilize detection signatures to identify and block adverse traffic entering into the network. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. | |
M1037 | This technique enforces the usage of network applications to filter ingress, egress and lateral network traffic. Protocol-based filtering, enforcing firewall rules and applying predefined conditions help restrict adversary movement and limit unauthorized access across systems. | |
M1020 | The technique involves the process of decrypting the encrypting HTTPS traffic to analyze its content and checks for any malicious material and then allow further into the network. | |
M1021 | Restrict web-based content by enforcing policies or tools that limit access to malicious sites, applications, browser extensions, etc,. |
