ET EXPLOIT Microsoft LDAP Referral Response Inbound (CVE-2024-49113)

alert udp $EXTERNAL_NET 389 -> $HOME_NET any (
    msg:"ET EXPLOIT Microsoft LDAP Referral Response Inbound (CVE-2024-49113)";
    content:"|30|"; depth:1;
    content:"|04|"; distance:2; within:1;
    content:"|65|"; distance:4; within:1;
    content:"|0a 01|"; distance:1; within:2;
    content:"|a3|"; distance:0;
    content:"ldap"; within:7;
    pcre:"/^s?\x3a\x2f{2}/R";
    reference:url,www.safebreach.com/blog/ldapnightmare-safebreach-labs-publishes-first-proof-of-concept-exploit-for-cve-2024-49113/;
    reference:cve,2024-49113;
    classtype:attempted-dos;
    sid:2059017; rev:1;
    metadata:affected_product Windows_11, affected_product Windows_Server_2019, affected_product Windows_Server_2022, affected_product Windows_Server_2016, affected_product Windows_10, affected_product Windows_Server_2012, attack_target Networking_Equipment, created_at 2025_01_07, cve CVE_2024_49113, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence High, signature_severity Major, tag Exploit, updated_at 2025_01_07, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1498, mitre_technique_name Network_Denial_of_Service;
    target:dest_ip;
)