Windows Application Error: Possible CVE-2024-49113 LDAP Nightmare Attempt (lsass.exe, WLDAP32.dll)

title: "Windows Application Error: Possible CVE-2024-49113 LDAP Nightmare Attempt (lsass.exe, WLDAP32.dll)"
id: 9ad2c5b9-7200-4b9a-9f1f-0bf41e3196f5
status: experimental
description: This rule flags Windows Application Error events (EventID 1000) whose event data indicates the faulting application is lsass.exe and the faulting module is WLDAP32.dll, consistent with exploitation attempts for CVE-2024-49113. Attackers may leverage LDAP-related components to disrupt or compromise access paths, making faults in lsass.exe and WLDAP32.dll particularly noteworthy. It relies on Windows application error telemetry with Provider_Name set to Application Error and the presence of both strings in the event data.
references:
  - https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
  - https://www.linkedin.com/feed/update/urn:li:activity:7282295814792605698/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-49113/win_application_error_exploit_cve_2024_49113_ldap_nightmare.yml
author: Samuel Monsempes, Huntrule Team
date: 2025-01-08
tags:
  - attack.impact
  - attack.t1499
  - cve.2024-49113
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    Data|contains|all:
      - lsass.exe
      - WLDAP32.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148
    type: derived