{"id":"d22df9cd-2aee-4089-93c7-9dc4eae77f2c","title":"ISATAP Router Address Was Set","description":"Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.\nIn such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.\nThis detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.\n","author":"hamid","status":"experimental","level":"medium","date":"2025-10-19","modified":"","tags":["attack.impact","attack.credential-access","attack.collection","attack.initial-access","attack.privilege-escalation","attack.execution","attack.t1557","attack.t1565.002"],"technique_ids":["T1557","T1565.002"],"logsource":{"product":"windows","service":"system"},"falsepositives":["Legitimate ISATAP router configuration in enterprise environments","IPv6 transition projects and network infrastructure changes","Network administrators configuring dual-stack networking","Automatic ISATAP configuration in some Windows deployments"],"references":["https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/","https://redfoxsec.com/blog/ipv6-dns-takeover/","https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/","https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f"],"source_path":"rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml","source_sha256":"f23ed55bb1413a68772e71e189df78f75b07b214570213841395439512c07b18","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ISATAP Router Address Was Set\nid: d22df9cd-2aee-4089-93c7-9dc4eae77f2c\nstatus: experimental\ndescription: |\n    Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.\n    In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.\n    This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.\nreferences:\n    - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/\n    - https://redfoxsec.com/blog/ipv6-dns-takeover/\n    - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/\n    - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f\nauthor: hamid\ndate: 2025-10-19\ntags:\n    - attack.impact\n    - attack.credential-access\n    - attack.collection\n    - attack.initial-access\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.t1557\n    - attack.t1565.002\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 4100\n        Provider_Name: 'Microsoft-Windows-Iphlpsvc'\n    filter_main_localhost:\n        IsatapRouter:\n            - '127.0.0.1'\n            - '::1'\n    filter_optional_null:\n        IsatapRouter: null\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate ISATAP router configuration in enterprise environments\n    - IPv6 transition projects and network infrastructure changes\n    - Network administrators configuring dual-stack networking\n    - Automatic ISATAP configuration in some Windows deployments\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1557","id":"T1557","name":"Adversary-in-the-Middle","page":"techniques/enterprise/T1557/"},{"key":"enterprise/T1565.002","id":"T1565.002","name":"Transmitted Data Manipulation","page":"techniques/enterprise/T1565.002/"}],"data_path":"data/detection-rules/d22df9cd-2aee-4089-93c7-9dc4eae77f2c.json","kind":"sigma"}