Query: write Sigma for Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology fo
Matching passage: Sigma rule: Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology fo. Logsource: windows / system. Rule: title: ISATAP Router Address Was Set id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c status: experimental description: 'Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment. ' references: - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/ - https://redfoxsec.com/blog/ipv6-dns-takeover/ - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/ - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f author: hamid date: 2025-10-19 tags: - attack.impact - attack.credential-access - attack.collection - attack.initial-access - attack.privilege-escalation - attack.execution - attack.t1557 - attack.t1565.002 logsource: product: windows service: system detection: selection: EventID: 4100 Provider_Name: Microsoft-Windows-Iphlpsvc filter_main_localhost: IsatapRouter: - 127.0.0.1 - ::1 filter_optional_null: IsatapRouter: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate ISATAP router configuration in enterprise environments - IPv6 transition projects and network infrastructure changes - Network administrators configuring dual-stack networking - Automatic ISATAP configuration in some Windows deployments level: medium
Near-miss passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / process_creation. Rule: title: AADInternals PowerShell Cmdlets Execution - ProccessCreation id: c86500e9-a645-4680-98d7-f882c70c1ea3 related: - id: 91e69562-2426-42ce-a647-711b8152ced6 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_cli: CommandLine|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: high