Tailscale serve exposed on all interfaces via TS_SERVE_ALLOW_ALL_INTERFACES
Detects the setting of the TS_SERVE_ALLOW_ALL_INTERFACES environment variable or registry key combined with the execution of Tailscale serve or funnel commands on the same device within a 24-hour window, potentially indicating unauthorized exposure of local services.
Microsoft Sentinel (KQL)

