Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.

FreeReviewedSigma · Medium · v2

Product: windows
Service: system
Author: hamid (SigmaHQ), DRL 1.1
Published: 2025-10-19
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access → Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact
- T1565.002Transmitted Data Manipulation

What it detects

This rule identifies a Windows host where an ISATAP router address is configured, using Microsoft-Windows-Iphlpsvc Event ID 4100. Setting an ISATAP router affects IPv6 name resolution and traffic flow, which can be leveraged by attackers to intercept or redirect communications. The rule relies on Windows System event telemetry from the Iphlpsvc provider and filters out localhost and null values to reduce noise.

Reporting behind it

Related detections9 linkedT1557 — drag to rearrange

Suspicious Tycoon 2FA Phishing Script Retrieval

Suspicious Firefox Enterprise Root Certificate Trust Enabled

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

Suspicious Code of Conduct Phishing Email From cocinternal.com Sender (via m365)

Suspicious Entra Sign-In With Axios Automation User-Agent via AiTM Token Replay (via azure)

Suspicious Tycoon Phishing-as-a-Service Credential Exfiltration Path (via proxy)

Suspicious OfficeHome Sign-In With Axios User Agent via Tycoon 2FA Proxy

Suspicious AWS AiTM Phishing Kit Endpoint Access via Proxy

Possible AiTM Phishing Sign-On Evaluation Denied by Okta FastPass

Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Pivot detection · T1557 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-isatap-router-address-configuration-set-microsoft-windows-iphlpsvc-d22df9cd

title: "Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100"
id: 4048b244-5b46-4d7d-90c1-1da564212790
status: experimental
description: This rule identifies a Windows host where an ISATAP router address is configured, using Microsoft-Windows-Iphlpsvc Event ID 4100. Setting an ISATAP router affects IPv6 name resolution and traffic flow, which can be leveraged by attackers to intercept or redirect communications. The rule relies on Windows System event telemetry from the Iphlpsvc provider and filters out localhost and null values to reduce noise.
references:
  - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
  - https://redfoxsec.com/blog/ipv6-dns-takeover/
  - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
  - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml
author: hamid, Huntrule Team
date: 2025-10-19
tags:
  - attack.impact
  - attack.credential-access
  - attack.collection
  - attack.initial-access
  - attack.privilege-escalation
  - attack.execution
  - attack.t1557
  - attack.t1565.002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 4100
    Provider_Name: Microsoft-Windows-Iphlpsvc
  filter_main_localhost:
    IsatapRouter:
      - 127.0.0.1
      - ::1
  filter_optional_null:
    IsatapRouter: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate ISATAP router configuration in enterprise environments
  - IPv6 transition projects and network infrastructure changes
  - Network administrators configuring dual-stack networking
  - Automatic ISATAP configuration in some Windows deployments
level: medium
license: DRL-1.1
related:
  - id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL