Tailscale Installation and Mesh VPN Tunnel Establishment - Operation Poisson

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.