Detection rules › Sigma
ISATAP Router Address Was Set
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1557 Adversary-in-the-Middle |
| Collection | T1557 Adversary-in-the-Middle |
| Impact | T1565.002 Data Manipulation: Transmitted Data Manipulation |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Iphlpsvc | Event ID 4100 | ISATAP router address IsatapRouter was set with status ErrorCode. |
Rule body yaml
title: ISATAP Router Address Was Set
id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c
status: experimental
description: |
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
references:
- https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
- https://redfoxsec.com/blog/ipv6-dns-takeover/
- https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
- https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
author: hamid
date: 2025-10-19
tags:
- attack.impact
- attack.credential-access
- attack.collection
- attack.initial-access
- attack.privilege-escalation
- attack.execution
- attack.t1557
- attack.t1565.002
logsource:
product: windows
service: system
detection:
selection:
EventID: 4100
Provider_Name: 'Microsoft-Windows-Iphlpsvc'
filter_main_localhost:
IsatapRouter:
- '127.0.0.1'
- '::1'
filter_optional_null:
IsatapRouter: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate ISATAP router configuration in enterprise environments
- IPv6 transition projects and network infrastructure changes
- Network administrators configuring dual-stack networking
- Automatic ISATAP configuration in some Windows deployments
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_* and not 1 of filter_optional_*Stage 1: selection
selection:
EventID: 4100
Provider_Name: 'Microsoft-Windows-Iphlpsvc'
Stage 2: not filter_main_localhost
filter_main_localhost:
IsatapRouter:
- '127.0.0.1'
- '::1'
Stage 3: not filter_optional_null
filter_optional_null:
IsatapRouter: null
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
IsatapRouter | eq | 127.0.0.1 |
IsatapRouter | eq | ::1 |
IsatapRouter | is_null |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Provider_Name | eq |
|