Operation Poisson: Tailscale Installation for Persistent Mesh Network Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the installation, service creation, registry modification, and network activity associated with the Tailscale VPN tool. This rule monitors for persistent use of Tailscale, which can be utilized by threat actors to establish encrypted mesh access to internal environments.