↳ GitHub sourceAnalytics ruleMedium

Tailscale: Device started advertising subnet routes

Description

Identifies when a tailnet device begins advertising subnet routes (subnet-router capability) not present in the previous snapshot. Unexpected advertisement may indicate a compromised node expanding reachable surface area or an unsanctioned admin change.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 1h
Query period: 1d
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

TailscaleCCF

Data types

Tailscale_Devices_CL

KQL query

Original query, unchanged.

let recent =
    Tailscale_Devices_CL
    | where TimeGenerated > ago(1h)
    | summarize arg_max(TimeGenerated, *) by DeviceId
    | where array_length(AdvertisedRoutes) > 0;
let baseline =
    Tailscale_Devices_CL
    | where TimeGenerated between (ago(1d + 1h) .. ago(1h))
    | summarize arg_max(TimeGenerated, *) by DeviceId
    | where array_length(AdvertisedRoutes) > 0
    | distinct DeviceId;
recent
| join kind=leftanti baseline on DeviceId
| project TimeGenerated, DeviceId, DeviceName, Hostname, User, AdvertisedRoutes, EnabledRoutes, LastSeen

Declared entities

HostAccount

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceAdvertisingSubnetRoutes.yaml ↗
Commit: 9800e51 ↗
Source identifier: c2b3d4e5-2345-6789-01ab-cdef12345002

Additional source files 2

Solutions/Tailscale (CCF)/Analytic Rules/TailscaleDeviceAdvertisingSubnetRoutes.yamlsource ↗Solutions/Tailscale (CCF)/Data/Solution_Tailscale.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.