Sunturai
Back to results
MediumSigmaHQhamid

ISATAP Router Address Was Set

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a…

Description

Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.

Detection logic

Detection requirements

Platform
LinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
windows
Log source service
system

Known benign triggers

  • Automatic ISATAP configuration in some Windows deployments
  • IPv6 transition projects and network infrastructure changes
  • Legitimate ISATAP router configuration in enterprise environments
  • Network administrators configuring dual-stack networking

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice