Tailscale SSH ssh -L Unix socket forward then /etc/shadow or docker.sock access

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•4•0•9

Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.