Tailscaled or tailscale accessing /etc/shadow or root-only sockets (Tailworm)

Detects instances where the tailscaled or tailscale process accesses sensitive system files such as /etc/shadow or Docker/Tailscale Unix sockets.