Potential Tunneling via Tailscaled

  1[metadata]
  2creation_date = "2026/07/29"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/08/03"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the use of Tailscaled to potentially tunnel network traffic. This can be used by attackers to enable
 11routing of network packets that would otherwise not reach their intended destination, or to bypass network restrictions
 12and/or hide traffic from network monitoring.
 13"""
 14from = "now-9m"
 15index = [
 16    "endgame-*",
 17    "logs-crowdstrike.fdr*",
 18    "logs-endpoint.events.process-*",
 19    "logs-m365_defender.event-*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21    "logs-system.security*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24    "auditbeat-*"
 25]
 26language = "eql"
 27license = "Elastic License v2"
 28name = "Potential Tunneling via Tailscaled"
 29note = """ ## Triage and analysis
 30
 31> **Disclaimer**:
 32> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 33
 34### Investigating Potential Tunneling via Tailscaled
 35
 36This rule flags Tailscaled starting with proxy or SOCKS tunneling options, which can turn an endpoint into a covert relay for traffic that bypasses segmentation, egress controls, and normal monitoring. An attacker with access to a Windows, Linux, or macOS host can launch tailscaled.exe with a local SOCKS5 listener, then route remote administration, reconnaissance, or data-transfer traffic through the encrypted overlay to reach systems that were not directly accessible.
 37
 38### Possible investigation steps
 39
 40- Determine whether the host is approved to run Tailscale by validating the user, device owner, recent change tickets, and any sanctioned remote-access or VPN use case.
 41- Review the execution chain and security context, including the parent process, command lineage, account privileges, logon session, and whether a service, scheduled task, or startup item was created to keep the tunnel available.
 42- Identify what the tunnel exposed by enumerating local listening ports, recent inbound and outbound connections, and any access to unusual internal subnets, administrative services, or blocked destinations after the process started.
 43- Correlate Tailscale-specific artifacts such as the logged-in tailnet, device registration or approval events, peer list, and advertised routes or exit-node settings to determine whether the node was joined to an unauthorized overlay.
 44- Hunt across the environment for the same user, tailnet, binary path, hash, or command pattern and review adjacent activity on the host for follow-on actions like remote administration, lateral movement, credential access, or data staging.
 45
 46### False positive analysis
 47
 48- An administrator or engineer may legitimately start tailscaled with `--socks5-server` or `--outbound-http-proxy-listen` on an approved remote-access, lab, or jump system for maintenance, so verify the user and host are authorized for Tailscale and that the command line, install path, and start time match a documented change or normal operating pattern.
 49- A developer or IT user may temporarily enable these proxy options to troubleshoot connectivity between managed Windows, Linux, or macOS hosts, so confirm the activity with the asset owner and review resulting connections to ensure they were limited to expected internal destinations and business-related use.
 50
 51### Response and remediation
 52
 53- Isolate the affected host from the network, terminate the running `tailscaled` process, and block the observed local proxy listener and any active Tailscale peer connections to stop the tunnel.
 54- Remove attacker persistence by uninstalling unauthorized Tailscale components and deleting related services, scheduled tasks, LaunchDaemons, systemd units, startup items, auth keys, and Tailscale state/config files left on the host.
 55- Revoke the enrolled device from the tailnet, invalidate any Tailscale auth keys or SSO sessions used to register it, and reset passwords or tokens for accounts that logged on while the tunnel was active.
 56- Restore the system to a known-good state by reimaging or recovering from a trusted backup if you cannot fully verify what the tunnel exposed or what changes were made after `tailscaled` was launched with proxy options.
 57- Escalate to incident response immediately if the tunnel reached domain controllers, administrative jump hosts, sensitive data repositories, or if you identify the same tailnet, binary, or proxy command line on multiple endpoints.
 58- Harden the environment by restricting Tailscale installation to approved systems, enforcing application control for `tailscaled`, limiting outbound access to Tailscale coordination or relay infrastructure where not required, and alerting on new proxy listeners or unauthorized tailnet enrollments.
 59
 60"""
 61references = [
 62    "https://huggingface.co/blog/agent-intrusion-technical-timeline",
 63]
 64risk_score = 47
 65rule_id = "482a5584-4ce4-4838-b806-0839a39b004f"
 66severity = "medium"
 67tags = [
 68    "Domain: Endpoint",
 69    "OS: Windows",
 70    "OS: Linux",
 71    "OS: macOS",
 72    "Use Case: Threat Detection",
 73    "Tactic: Command and Control",
 74    "Data Source: Elastic Endgame",
 75    "Data Source: Elastic Defend",
 76    "Data Source: Sysmon",
 77    "Data Source: SentinelOne",
 78    "Data Source: Microsoft Defender XDR",
 79    "Data Source: Windows Security Event Logs",
 80    "Data Source: Crowdstrike",
 81    "Resources: Investigation Guide"
 82]
 83timestamp_override = "event.ingested"
 84type = "eql"
 85query = '''
 86process where event.type == "start" and
 87process.name like~ ("tailscaled", "tailscaled.exe") and
 88process.args like~ ("*--socks5-server*", "*--outbound-http-proxy-listen*")
 89'''
 90
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93
 94[[rule.threat.technique]]
 95id = "T1090"
 96name = "Proxy"
 97reference = "https://attack.mitre.org/techniques/T1090/"
 98
 99[[rule.threat.technique]]
100id = "T1219"
101name = "Remote Access Tools"
102reference = "https://attack.mitre.org/techniques/T1219/"
103
104[[rule.threat.technique]]
105id = "T1572"
106name = "Protocol Tunneling"
107reference = "https://attack.mitre.org/techniques/T1572/"
108
109[rule.threat.tactic]
110id = "TA0011"
111name = "Command and Control"
112reference = "https://attack.mitre.org/tactics/TA0011/"