Open
Description
Reading the cve in the subject I created this rule that you could include in your pool.... Please verify the correctness of the rule and also send me the changes and post it. Thank you for your attention
title: Rilevamento di tentativi di exploit per CVE-2024-49112 (LDAPNightmare)
id: b7f9e2d2-3c4a-4f8e-9a6e-2d3c4a5f8e9a
status: experimental
description: Rileva tentativi di sfruttamento della vulnerabilità CVE-2024-49112 nel servizio LDAP di Windows.
references:
- https://www.cve.org/CVERecord?id=CVE-2024-49112
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49112
author: Michele "Devilman" Boschetto
date: 2025/01/02
logsource:
product: windows
service: security
category: directory-service
detection:
selection:
EventID: 1644
LDAPResultCode: 52
condition: selection
falsepositives: - Operazioni LDAP legittime che generano errori specifici; è necessario verificare il contesto.
level: critical
tags: - attack.privilege_escalation
- attack.credential_access
- attack.initial_access
- cve.cve-2024-49112
- protocol.ldap
tactics: - Privilege Escalation
- Credential Access
- Initial Access
required_fields: - EventID
- LDAPResultCode
query: >
event.category == "directory-service" and
event.action == "error" and
EventID == 1644 and
LDAPResultCode == 52
integration: - Windows
- System
Metadata
Metadata
Assignees
Labels
No labels