CVE2024

CVE-2024-49113

1Rules

6References

1Folders

2026-11-03Latest

Summary

CVE-2024-49113 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2024. Coverage centers on windows / application.

Related Detections

Search this threat

highexperimentalEmerging Threat

CVE-2024-49113 Exploitation Attempt - LDAP Nightmare

Detects an Application Error (EventID 1000) where LSASS crashes in the Windows LDAP client module WLDAP32.dll. This is the crash telemetry produced by the public LDAP Nightmare proof-of-concept for CVE-2024-49113 (denial of service). CVE-2024-49112 is the related LDAP remote code execution issue on the same LDAP client path. The published exploit chain covers the denial of service only: code execution would run inside LSASS and leave no Windows log of its own. The cve.2024-49112 tag marks that shared path, not a coverage claim: this rule detects the CVE-2024-49113 denial of service only.

windowsapplication2 samples

2026-11-03

References