Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when HTTPS has been disabled for a Tailscale tailnet.

Strategy

This rule monitors Tailscale logs where @evt.name is DISABLE, @target.type is TAILNET, and @target.property is HTTPS. Disabling HTTPS for the tailnet reduces transport-layer security and could expose administrative or user traffic to interception. An attacker disabling this could be an attempt to weaken network defenses.

Triage and response

• Investigate the user {{@usr.name}} that disabled HTTPS on the tailnet.
• Review change management records for a planned maintenance or troubleshooting exception.
• Determine the scope of impact and whether other security controls remain in place.
• If the activity is not expected, begin your organization’s incident response process and investigate.