Sigma rule: ISATAP Router Address Was Set

Rule

Title

ISATAP Router Address Was Set

Status

experimental

Level

medium

Author

hamid

Date

2025-10-19

File

rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

Log source

product

windows

service

system

Detection

selection:
    EventID: 4100
    Provider_Name: 'Microsoft-Windows-Iphlpsvc'
filter_main_localhost:
    IsatapRouter:
        - '127.0.0.1'
        - '::1'
filter_optional_null:
    IsatapRouter: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate ISATAP router configuration in enterprise environments
• IPv6 transition projects and network infrastructure changes
• Network administrators configuring dual-stack networking
• Automatic ISATAP configuration in some Windows deployments

Tags

• attack.impact
• attack.credential-access
• attack.collection
• attack.initial-access
• attack.privilege-escalation
• attack.execution
• attack.t1557
• attack.t1565.002

MITRE ATT&CK ids this rule names

• T1557
• T1565.002

References

• https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
• https://redfoxsec.com/blog/ipv6-dns-takeover/
• https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
• https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml