Tailscale host non-root ssh -R Unix socket forwarding (reduced FP)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•1

Detects non-root SSH execution performing remote port forwarding (-R) targeting a Unix socket bind on hosts running the tailscaled daemon, excluding known automation tools.