Detectionmediumexperimental

ISATAP Router Address Was Set

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
hamidCreated Sun Oct 19d22df9cd-2aee-4089-93c7-9dc4eae77f2cwindows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic3 selectors
detection:
    selection:
        EventID: 4100
        Provider_Name: 'Microsoft-Windows-Iphlpsvc'
    filter_main_localhost:
        IsatapRouter:
            - '127.0.0.1'
            - '::1'
    filter_optional_null:
        IsatapRouter: null
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
False Positives

Legitimate ISATAP router configuration in enterprise environments

IPv6 transition projects and network infrastructure changes

Network administrators configuring dual-stack networking

Automatic ISATAP configuration in some Windows deployments

Rule Metadata
Rule ID
d22df9cd-2aee-4089-93c7-9dc4eae77f2c
Status
experimental
Level
medium
Type
Detection
Created
Sun Oct 19
Author
Path
rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml
Raw Tags
attack.impactattack.credential-accessattack.collectionattack.initial-accessattack.privilege-escalationattack.executionattack.t1557attack.t1565.002
View on GitHub