Tailscale Connector Access to Cloud Metadata or K8s
Detects Tailscale (tailscaled) reaching out to cloud instance metadata endpoints or Kubernetes internal service APIs, which may indicate unauthorized access or abuse of app connectors.
Microsoft Sentinel (KQL)

