Tailscaled spawning root shell or interpreter (Tailscale SSH forwarding escalati

Suraj A@cytech

•updated yesterday•1•0•2

Detects the tailscaled daemon spawning a shell or interpreter (such as sh, bash, python, nc, etc.) running as the root user, which may indicate Tailscale SSH socket forwarding or related root privilege escalation techniques (Tailworm F1/F2).