alert dns $HOME_NET any -> any any (msg:"ET INFO Tailscale Control Pane in DNS Query"; dns.query; content:"controlplane.tailscale.com"; fast_pattern; nocase; endswith; reference:url,tailscale.com/docs/how-to/set-up-custom-control-server; classtype:misc-activity; sid:2071637; rev:1; metadata:created_at 2026_08_20, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, updated_at 2026_08_20;)