Microsoft Sentinel high experimental kql

Tailscale: OAuth client or API key created with write scopes

Identifies creation of a Tailscale OAuth client or API access key whose granted scopes include WRITE permissions (anything matching :write). Tokens with write scopes are high-value adversary targets.

View Source

Detection Logic

Tailscale_Audit_CL
| where EventType == "CONFIG"
| where Action == "CREATE"
| where tostring(Target.type) in ("API_KEY", "OAUTH_CLIENT")
| extend Scopes = extract(@"scopes\s*-\s*(.+)$", 1, ActionDetails)
| where Scopes contains ":write"
| extend WriteScopes = extract_all(@"([a-zA-Z_]+:write)", Scopes)
| extend ActorLogin = tostring(Actor.loginName)
| extend ActorType = tostring(Actor.type)
| extend TargetName = tostring(Target.name)
| extend TargetId = tostring(Target.id)
| extend TargetType = tostring(Target.type)
| project TimeGenerated, ActorLogin, ActorType, Action, TargetType, TargetName, TargetId, WriteScopes, Scopes, Origin, ActionDetails

Field Validations

Loading…

Comments (0)

Loading comments...