Tailscale: OAuth client or API key created with write scopes

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies creation of a Tailscale OAuth client or API access key whose granted scopes include WRITE permissions (anything matching :write). Tokens with write scopes are high-value adversary targets.

Attribute	Value
Type	Analytic Rule
Solution	Tailscale (CCF)
ID	7237a848-30f2-499b-9ad5-024aea1288bd
Severity	High
Status	Available
Kind	Scheduled
Tactics	Persistence, PrivilegeEscalation
Techniques	T1098, T1136
Required Connectors	TailscaleCCF, TailscalePremiumCCF
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
Tailscale_Audit_CL		?	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Tailscale (CCF)