Sigma Rules

CVE-2024-49113 Exploitation Attempt - LDAP Nightmare

Detects an Application Error (EventID 1000) where LSASS crashes in the Windows LDAP client module WLDAP32.dll. This is the crash telemetry produced by the public LDAP Nightmare proof-of-concept for CVE-2024-49113 (denial of service). CVE-2024-49112 is the related LDAP remote code execution issue on the same LDAP client path. The published exploit chain covers the denial of service only: code execution would run inside LSASS and leave no Windows log of its own. The cve.2024-49112 tag marks that shared path, not a coverage claim: this rule detects the CVE-2024-49113 denial of service only.