Communication To LocaltoNet Tunneling Service Initiated - Linux (c4568f5d-131f-4e78-83d4-45b2da0ec4f1)
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.