Tailscale enrollment on newly seen devices followed by control-plane traffic

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•2

Detects newly seen devices (no Tailscale process activity in the prior 30 days) executing Tailscale enrollment or login commands followed by outbound network connections to Tailscale control infrastructure within 10 minutes, potentially indicating unauthorized VPN tunneling.