Communication To LocaltoNet Tunneling Service Initiated (3ab65069-d82a-4d44-a759-466661a082d1)
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.