LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49112

[rohan097]

Hi , 

How to check for the below actions in xql builder.

please help in developing a query 

1. The attacker sends a DCE/RPC request to the Victim Server Machine
2. The Victim is triggered to send a DNS SRV query about SafeBreachLabs.pro
3. The Attacker’s DNS server responds with the Attacker’s hostname machine and LDAP port 
4. The Victim sends a broadcast NBNS request to find the IP address of the received hostname (of the Attacker’s)
5. The Attacker sends an NBNS response with its IP Address
6. The Victim becomes an LDAP client and sends a CLDAP request to the Attacker’s machine
7. The Attacker sends a CLDAP referral response packet with a specific value resulting in LSASS to crash and force a reboot of the Victim server

[tlmarques]

I've open a administrative case for get informations about XDR and if XDR prevent the attack and how we can search on XQL.

[tlmarques]

@rohan097 , official response is:

"...there is currently no Proof of Concept (PoC) available for this CVE, which means coverage is not possible at this time. However, it has been added to our monitoring list, and coverage will be implemented as soon as a valid PoC is identified."

For more details, you can refer to this article:
[Knowledge Base Article](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAOnCAO)