Suspicious ISATAP Router Address Was Set (via system)

title: Suspicious ISATAP Router Address Was Set (via system)
id: 66f94601-6918-5e11-83e9-68827ca35884
status: stable
description: This rule detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, threat actors advertise themselves as DHCPv6 servers and set hostile ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
references:
    - https://attack.mitre.org/techniques/T1565/002/
    - https://attack.mitre.org/techniques/T1557/
    - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
    - https://redfoxsec.com/blog/ipv6-dns-takeover/
    - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
    - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
author: Huntrule Team
date: 2026-06-28
tags:
    - attack.impact
    - attack.credential-access
    - attack.collection
    - attack.initial-access
    - attack.privilege-escalation
    - attack.execution
    - attack.t1557
    - attack.t1565.002
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 4100
        Provider_Name: 'Microsoft-Windows-Iphlpsvc'
    filter_main_localhost:
        IsatapRouter:
            - '127.0.0.1'
            - '::1'
    filter_optional_null:
        IsatapRouter:
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium