Tailscaled or tailscale accessing /etc/shadow or root-only sockets (Tailworm)
Detects instances where the tailscaled or tailscale process accesses sensitive system files such as /etc/shadow or Docker/Tailscale Unix sockets.
Microsoft Sentinel (KQL)

Detects instances where the tailscaled or tailscale process accesses sensitive system files such as /etc/shadow or Docker/Tailscale Unix sockets.

Already have an account?