Tailscale: Auth key created

Status: available
Severity: low
Time window: 15m
Source: github.com/Azure/Azure-Sentinel

Identifies when a new Tailscale auth key is generated. Auth keys allow unattended device enrollment into the tailnet - confirm it was expected and revoke if not.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Rule body

id: 6b052c8d-5de8-eab0-1956-69a297765a32
name: "Tailscale: Auth key created"
description: |
  Identifies when a new Tailscale auth key is generated. Auth keys allow unattended device enrollment into the tailnet - confirm it was expected and revoke if not.
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: TailscaleCCF
    dataTypes:
      - Tailscale_Audit_CL
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T1098
query: |
  Tailscale_Audit_CL
        | where Action == "CREATE"
        | where tostring(Target.type) == "AUTH_KEY"
        | extend ActorLogin = tostring(Actor.loginName)
        | extend KeyDescription = tostring(New.description)
        | extend Reusable = tostring(New.reusable)
        | extend Ephemeral = tostring(New.ephemeral)
        | project TimeGenerated, ActorLogin, KeyDescription, Reusable, Ephemeral, Origin, New
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorLogin
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.0

Stages and Predicates

Stage 1: `source`

Tailscale_Audit_CL

Stage 2: `where`

| where Action == "CREATE"

Stage 3: `where`

| where tostring(Target.type) == "AUTH_KEY"

Stage 4: `extend` (4 consecutive steps)

| extend ActorLogin = tostring(Actor.loginName)
| extend KeyDescription = tostring(New.description)
| extend Reusable = tostring(New.reusable)
| extend Ephemeral = tostring(New.ephemeral)

Stage 5: `project`

| project TimeGenerated, ActorLogin, KeyDescription, Reusable, Ephemeral, Origin, New

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`CREATE`	`field:"Action" kind:eq value:"CREATE"`
`type`	eq	`AUTH_KEY` transforms: `tostring`	`field:"type" kind:eq value:"AUTH_KEY"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActorLogin`	`project`
`Ephemeral`	`project`
`KeyDescription`	`project`
`New`	`project`
`Origin`	`project`
`Reusable`	`project`
`TimeGenerated`	`project`

Tailscale: Auth key created

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend (4 consecutive steps)