Possible CVE-2024-49113 LDAPNightmare Exploitation

Aaron Mog@amog

•updated Nov 11, 2025•2•1•84

Detects the crash of lsass.exe caused by WLDAP32.dll, which is a strong indicator of exploitation of the LDAPNightmare vulnerability (CVE-2024-49113). This exploit causes a denial of service on unpatched Windows Servers.