https://detection.fyi/tags/cve.2024-49112/ Recent content in cve.2024-49112 on Detection.FYI Hugo -- gohugo.io Tue, 03 Nov 2026 07:07:21 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2024/exploits/cve-2024-49113/win_application_error_exploit_cve_2024_49113_ldap_nightmare/ Tue, 03 Nov 2026 07:07:21 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2024/exploits/cve-2024-49113/win_application_error_exploit_cve_2024_49113_ldap_nightmare/ Detects an Application Error (EventID 1000) where LSASS crashes in the Windows LDAP client module WLDAP32.dll. This is the crash telemetry produced by the public LDAP Nightmare proof-of-concept for CVE-2024-49113 (denial of service). CVE-2024-49112 is the related LDAP remote code execution issue on the same LDAP client path. The published exploit chain covers the denial of service only: code execution would run inside LSASS and leave no Windows log of its own. The cve.2024-49112 tag marks that shared path, not a coverage claim: this rule detects the CVE-2024-49113 denial of service only.