Windows: ISATAP Router Address Configuration Set (Microsoft-Windows-Iphlpsvc)

Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.

FreeUnreviewedSigmamediumv1

windows-isatap-router-address-configuration-set-microsoft-windows-iphlpsvc-d22df9cd

title: "Windows: ISATAP Router Address Configuration Set (Microsoft-Windows-Iphlpsvc)"
id: 4048b244-5b46-4d7d-90c1-1da564212790
status: experimental
description: This rule flags a Windows system event indicating that an ISATAP router address was configured. Unexpected ISATAP router settings can be abused to redirect IPv6-related traffic and support interception techniques, so monitoring changes helps identify potential unauthorized network configuration. The detection relies on Windows System telemetry from the Microsoft-Windows-Iphlpsvc provider (Event ID 4100) and matches the configured IsatapRouter value while excluding loopback and null cases.
references:
  - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
  - https://redfoxsec.com/blog/ipv6-dns-takeover/
  - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
  - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml
author: hamid, Huntrule Team
date: 2025-10-19
tags:
  - attack.impact
  - attack.credential-access
  - attack.collection
  - attack.initial-access
  - attack.privilege-escalation
  - attack.execution
  - attack.t1557
  - attack.t1565.002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 4100
    Provider_Name: Microsoft-Windows-Iphlpsvc
  filter_main_localhost:
    IsatapRouter:
      - 127.0.0.1
      - ::1
  filter_optional_null:
    IsatapRouter: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate ISATAP router configuration in enterprise environments
  - IPv6 transition projects and network infrastructure changes
  - Network administrators configuring dual-stack networking
  - Automatic ISATAP configuration in some Windows deployments
level: medium
license: DRL-1.1
related:
  - id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c
    type: derived

What it detects

This rule flags a Windows system event indicating that an ISATAP router address was configured. Unexpected ISATAP router settings can be abused to redirect IPv6-related traffic and support interception techniques, so monitoring changes helps identify potential unauthorized network configuration. The detection relies on Windows System telemetry from the Microsoft-Windows-Iphlpsvc provider (Event ID 4100) and matches the configured IsatapRouter value while excluding loopback and null cases.

Known false positives

Legitimate ISATAP router configuration in enterprise environments
IPv6 transition projects and network infrastructure changes
Network administrators configuring dual-stack networking
Automatic ISATAP configuration in some Windows deployments

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.