Potential CVE-2024-49113 - LDAPNightmare (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

SafeBreach Labs revealed a PoC for CVE-2024-49113, codenamed LDAPNightmare. The PoC is designed to crash any unpatched Windows Server with no prerequisites except that the DNS server of the victim domain controller has internet connectivity. This use case detects potential Windows LDAP Denial of Service Vulnerability events involving lsass.exe and the WLDAP32.dll module in application errors. Windows Application event 1000 is required for detection.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1499` Endpoint Denial of Service

References

Telemetry coverage

Provider	Record / event type
Application-Error	Event ID 1000: Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.

Rule body

id: '40834.75130'
title: Potential CVE-2024-49113 - LDAPNightmare
description: SafeBreach Labs revealed a PoC for CVE-2024-49113, codenamed LDAPNightmare.
  The PoC is designed to crash any unpatched Windows Server with no prerequisites
  except that the DNS server of the victim domain controller has internet connectivity.
  This use case detects potential Windows LDAP Denial of Service Vulnerability events
  involving lsass.exe and the WLDAP32.dll module in application errors. Windows Application
  event 1000 is required for detection.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1000) OR
  "<EventID>1000<") "lsass.exe" "WLDAP32.dll" | table _time, host, user user, process,
  process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- impact:endpoint denial of service
technique_id: 
- T1499
data_category:
- Windows event logs
references:
- https://github.com/SafeBreach-Labs/CVE-2024-49112?tab=readme-ov-file
- https://www.safebreach.com/blog/ldapnightmare-safebreach-labs-publishes-first-proof-of-concept-exploit-for-cve-2024-49112
- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
- https://github.com/SigmaHQ/sigma/pull/5155/files

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=1000) OR "<EventID>1000<") "lsass.exe" "WLDAP32.dll"

Stage 2: `table`

| table _time, host, user user, process, process_*, parent_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1000`	`field:"EventID" kind:eq value:"1000"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1000<"`
1	`"lsass.exe"`
1	`"WLDAP32.dll"`