Rule Info
Name
ISATAP Router Address Was Set
Author
hamid
Description
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Date
2025-10-19 00:00:00
Modified
None
Id
d22df9cd-2aee-4089-93c7-9dc4eae77f2c
Tags
attack.impact attack.credential-access attack.collection attack.initial-access attack.privilege-escalation attack.execution attack.t1557 attack.t1565.002
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR