Identifier / Programs / Linux and Unix
tailscale
A private WireGuard network service. Some subcommands such as up have their own usage documentation. tldr-pages
GTFOBins upload 1 documented command
How tailscale is abused
upload
serve
--httpEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tailscale.
1 documented command
upload with sudo
The URL is reachable by any host of the same Tailnet.
tailscale serve --http=12345 /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tailscale. The identifier reads the line that runs tailscale.
Everyday use
Allow the current user to operate on the Tailscale daemon
sudo tailscale set --operator $USERIdentifyHandle connection to Tailscale (connect, disconnect, check status)
tailscale upIdentifyOffer the current machine to be an exit node for internet traffic
tailscale set --advertise-exit-nodeIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.