PUA - Tailcat Saved Key Generation - Linux

Rule Info

Name
PUA - Tailcat Saved Key Generation - Linux
Author
Marius Benthin (Nextron Systems), Christian Burkard (Nextron Systems)
Description
Detects the generation of Tailcat saved keys that persist the secret between multiple sessions. Using Tailcat persistently is unusual in corporate environments.
Reference
https://github.com/tailscale/tailcat
Date
2026-09-02 00:00:00
Modified
None
Id
d6793f9b-1a1f-4633-a245-2ee578fe9faf
Tags
attack.defense-impairment attack.t1599
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022