Rule Info
Name
PUA_Tailcat_Sep26
Author
Christian Burkard, Marius Benthin
Description
Detects Tailcat executables and library usage. Tailcat is a tool like netcat, but over Tailscale's data plane, without Tailscale's control plane. Has SSH server, SOCKS5 proxy and file transfer capabilities.
Score
60
Reference
Date
2026-09-01
Minimum Yara
3.5.0
Rule Hash
e323d4e61dca3e8c67ba164db5261ae4
Tags
['EXE', 'T1021_004', 'FILE', 'T1090']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
10
Clean (0 engines)
3
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR