Operation Poisson Tailscale Enrollment for Persistent Mesh Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects Tailscale installation, configuration, and mesh network enrollment activity. The rule monitors for the execution of Tailscale processes with enrollment flags, DNS lookups to Tailscale coordination servers, WireGuard UDP traffic on port 41641, and connections to the Tailscale CGNAT IP address space. This activity is often used by adversaries to establish persistent, encrypted remote access.