tailscaled connecting to cloud metadata or Kubernetes API endpoints

Suraj A@cytech

•updated yesterday•0•0•2

Detects the tailscaled process communicating with cloud instance metadata endpoints (169.254.169.254, 169.254.170.2) or Kubernetes API/kubelet ports (6443, 10250), which may indicate app connector abuse or unauthorized internal resource enumeration.