Operation Poisson: Tailscale Mesh VPN Installation for Persistent Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.