CVE-2024-49113 Exploitation Attempt - LDAP Nightmare

Status: experimental
Severity: high
Log source: product windows, service application
Author: Samuel Monsempes
Source: github.com/SigmaHQ/sigma

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1499` Endpoint Denial of Service

Telemetry coverage

Provider	Record / event type
Application-Error	Event ID 1000: Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.

Rule body

title: CVE-2024-49113 Exploitation Attempt - LDAP Nightmare
id: 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148
status: experimental
description: |
    Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".
references:
    - https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
    - https://www.linkedin.com/feed/update/urn:li:activity:7282295814792605698/
author: Samuel Monsempes
date: 2025-01-08
tags:
    - attack.impact
    - attack.t1499
    - cve.2024-49113
    - detection.emerging-threats
logsource:
    product: windows
    service: application
    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
detection:
    selection:
        Provider_Name: 'Application Error'
        EventID: 1000
        Data|contains|all:
            - 'lsass.exe'
            - 'WLDAP32.dll'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Provider_Name: 'Application Error'
    EventID: 1000
    Data|contains|all:
        - 'lsass.exe'
        - 'WLDAP32.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Data`	match	`WLDAP32.dll` `lsass.exe`	`field:"Data" kind:match`
`Provider_Name`	eq	`Application Error` corpus 5 (sigma 5)	`field:"Provider_Name" kind:eq value:"Application Error"`