Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.

FreeReviewedSigma · Medium · v2

Product: windows
Service: system
Author: hamid (SigmaHQ), DRL 1.1
Published: 2025-10-19
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access → Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1557Adversary-in-the-Middle
Discovery
Lateral Movement
Collection
- T1557Adversary-in-the-Middle
C2
Exfiltration
Impact
- T1565.002Transmitted Data Manipulation

What it detects

This rule identifies a Windows host where an ISATAP router address is configured, using Microsoft-Windows-Iphlpsvc Event ID 4100. Setting an ISATAP router affects IPv6 name resolution and traffic flow, which can be leveraged by attackers to intercept or redirect communications. The rule relies on Windows System event telemetry from the Iphlpsvc provider and filters out localhost and null values to reduce noise.

Reporting behind it

Related detections9 linkedT1557 — drag to rearrange

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

Suspicious Sneaky 2FA Phishing Kit License Check via API Key Endpoint (via proxy)

Malicious TCP Session Hijacking via rshijack

Suspicious Entra ID Auth Broker Sign-In With Node.js User Agent via Tycoon 2FA

Malicious EdgeStepper iptables DNS Redirection for Adversary-in-the-Middle

Suspicious Tycoon 2FA Credential Exfiltration Fields

Suspicious Entra Sign-In to OfficeHome with axios User Agent

Suspicious Entra Sign-In Interrupt With High Aggregated Risk via AiTM DNS Hijacking (via azure)

Possible Adversary-in-the-Middle Proxy Login via Crafted URL Parameters

Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Pivot detection · T1557 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-isatap-router-address-configuration-set-microsoft-windows-iphlpsvc-d22df9cd

title: "Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100"
id: 4048b244-5b46-4d7d-90c1-1da564212790
status: experimental
description: This rule identifies a Windows host where an ISATAP router address is configured, using Microsoft-Windows-Iphlpsvc Event ID 4100. Setting an ISATAP router affects IPv6 name resolution and traffic flow, which can be leveraged by attackers to intercept or redirect communications. The rule relies on Windows System event telemetry from the Iphlpsvc provider and filters out localhost and null values to reduce noise.
references:
  - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
  - https://redfoxsec.com/blog/ipv6-dns-takeover/
  - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
  - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml
author: hamid, Huntrule Team
date: 2025-10-19
tags:
  - attack.impact
  - attack.credential-access
  - attack.collection
  - attack.initial-access
  - attack.privilege-escalation
  - attack.execution
  - attack.t1557
  - attack.t1565.002
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 4100
    Provider_Name: Microsoft-Windows-Iphlpsvc
  filter_main_localhost:
    IsatapRouter:
      - 127.0.0.1
      - ::1
  filter_optional_null:
    IsatapRouter: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate ISATAP router configuration in enterprise environments
  - IPv6 transition projects and network infrastructure changes
  - Network administrators configuring dual-stack networking
  - Automatic ISATAP configuration in some Windows deployments
level: medium
license: DRL-1.1
related:
  - id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL