medium
advisory
Microsoft Windows: ISATAP Router Configuration
Detects the configuration of an ISATAP router on a Windows host, which may indicate unauthorized activity related to IPv6 DNS takeover attacks.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 5 public sources
- Freshness
- Revision 1Nov 10, 02:36 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
ISATAP is a Microsoft technology for IPv6 transition. Adversaries may advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. Unauthorized ISATAP configurations should be correlated with network baselines and known legitimate deployments.
Detection coverage 1
Detect ISATAP Router Configuration
mediumDetects the configuration of a new ISATAP router on a Windows host via Event ID 4100.
sigma
techniques: T1557, T1565.002
sources: windows, system
Detection queries are available on the platform. Get full rules →