Tailscale HTTPS domain disabled

This rule is part of a beta feature. To learn more, contact Support.
tailscale

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect when HTTPS has been disabled for a Tailscale tailnet.

Strategy

This rule monitors Tailscale logs where @evt.name is DISABLE, @target.type is TAILNET, and @target.property is HTTPS. Disabling HTTPS for the tailnet reduces transport-layer security and could expose administrative or user traffic to interception. An attacker disabling this could be an attempt to weaken network defenses.

Triage and response

  • Investigate the user {{@usr.name}} that disabled HTTPS on the tailnet.
  • Review change management records for a planned maintenance or troubleshooting exception.
  • Determine the scope of impact and whether other security controls remain in place.
  • If the activity is not expected, begin your organization’s incident response process and investigate.