CVE-2024-49113 Exploitation Attempt - LDAP Nightmare

SigmaHQ Detections@sigmaHQ

•updated Jan 8, 2025•2•0•25

Detects exploitation attempts of CVE-2024-49113, known as LDAP Nightmare. This rule specifically looks for "Application Error" events (EventID 1000) where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll". This combination indicates a crash in the Local Security Authority Subsystem Service (LSASS) related to the Windows Lightweight Directory Access Protocol (LDAP) client library, which is consistent with the described vulnerability exploitation.