Tailscale serve/funnel to Unix socket or TS_SERVE_ALLOW_ALL_INTERFACES enabled
Detects the execution of Tailscale with commands indicating the use of 'serve' or 'funnel' features, potentially establishing unauthorized network tunnels or proxies.
Microsoft Sentinel (KQL)

