Windows Application Error 1000 with lsass.exe and WLDAP32.dll Indicating LDAP Nightmare Attempt (CVE-2024-49113)
Alerts on Windows Application Error (EventID 1000) showing lsass.exe crashing in WLDAP32.dll—potential CVE-2024-49113 exploitation attempt.
- Product
- windows
- Service
- application
- Author
- Samuel Monsempes (SigmaHQ), DRL 1.1
- Published
- 2025-01-08
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags Windows Application Error (EventID 1000) events where the recorded faulting process is lsass.exe and the faulting module is WLDAP32.dll, with Provider_Name set to Application Error. Such a crash/exception in these components can be triggered during exploitation activity matching the “LDAP Nightmare” pattern tied to CVE-2024-49113. It relies on application error telemetry that includes the provider name, event id, and the faulting process/module values in event data.
Reporting behind it
- gist.github.comhttps://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
- linkedin.comhttps://www.linkedin.com/feed/update/urn:li:activity:7282295814792605698/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-49113/win_application_error_exploit_cve_2024_49113_ldap_nightmare.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Application Error 1000 with lsass.exe and WLDAP32.dll Indicating LDAP Nightmare Attempt (CVE-2024-49113)
id: 9ad2c5b9-7200-4b9a-9f1f-0bf41e3196f5
status: experimental
description: This rule flags Windows Application Error (EventID 1000) events where the recorded faulting process is lsass.exe and the faulting module is WLDAP32.dll, with Provider_Name set to Application Error. Such a crash/exception in these components can be triggered during exploitation activity matching the “LDAP Nightmare” pattern tied to CVE-2024-49113. It relies on application error telemetry that includes the provider name, event id, and the faulting process/module values in event data.
references:
- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
- https://www.linkedin.com/feed/update/urn:li:activity:7282295814792605698/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-49113/win_application_error_exploit_cve_2024_49113_ldap_nightmare.yml
author: Samuel Monsempes, Huntrule Team
date: 2025-01-08
tags:
- attack.impact
- attack.t1499
- cve.2024-49113
- detection.emerging-threats
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
Data|contains|all:
- lsass.exe
- WLDAP32.dll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148
type: derived