Poisson: Tailscale Enrollment on Endpoint via tailscale up --authkey (T1572/T1219)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects the execution, installation, or configuration of Tailscale, a legitimate remote access tool. The rule monitors for common command-line arguments like '--authkey' and 'up', service-related activity, and execution from non-standard file paths. It flags instances where Tailscale is spawned by common script interpreters or command shells, which is a common indicator of unauthorized remote access or C2 implant activity.