R2L

R2L, short for remote-to-local, is a term used in cybersecurity to describe a class of attacks in which an attacker who does not have a valid local account on the target system attempts to gain local access. The attacker operates from a remote location and seeks to exploit vulnerabilities or misconfigurations to obtain a legitimate local account or higher privileges on the target machine.

R2L attacks typically rely on weaknesses in remote services or authentication mechanisms. Common methods include attempting to guess passwords, abusing insecure or misconfigured remote access services, and exploiting software vulnerabilities that can be triggered over a network. Because the attacker starts with no authorized access, successful R2L exploits often result in the attacker gaining a foothold on the system or escalating privileges from a lower level to a higher one.

In security research and defense, R2L is one of several broad attack categories used to classify intrusion attempts. It contrasts with DoS (denial of service), Probe (scanning and reconnaissance), and U2R (user to root) in intrusion detection and risk assessment frameworks. Datasets and studies that discuss R2L emphasize the need for robust authentication, patch management, and vigilant monitoring of remote access points.

Defensive measures against R2L include disabling or hardening unused remote services, enforcing strong authentication and multifactor authentication, applying timely security patches, employing least-privilege access controls, and deploying network-level and host-based intrusion detection systems. Regular auditing of logs, anomaly detection, and segmenting critical systems can also reduce the risk of successful remote-to-local compromises.