Elastic medium stable eql
Potential Tunneling via Tailscaled
Identifies the use of Tailscaled to potentially tunnel network traffic. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination, or to bypass network restrictions and/or hide traffic from network monitoring.
Detection Logic
process where event.type == "start" and
process.name like~ ("tailscaled", "tailscaled.exe") and
process.args like~ ("*--socks5-server*", "*--outbound-http-proxy-listen*")Field Validations
Loading…
Comments (0)
Loading comments...