Operation Poisson Tailscale/WireGuard C2 Tunnel and wawsenti DuckDNS Beacon
This rule detects suspicious network activity related to Tailscale mesh VPN and DuckDNS, specifically looking for resolutions of 'tailscale.com', 'wawsenti.duckdns.org', or 'duckdns.org' via DNS events, and network flow to known C2 IPs (217.154.217.139, 217.154.162.45), or traffic on UDP port 41641 within the Tailscale IP range (100.64.0.0/10). It also flags connections to 'wawsenti.duckdns.org' or any 'duckdns.org' domain in network flow data. The rule aims to identify potential C2 communications or unauthorized use of VPN services.
Microsoft Sentinel (KQL)
