Microsoft.LSAD

Description

This indicates an attempt to use the Microsoft Local Security Authority (Domain Policy) Remote Protocol (LSAD).
LSAD is Microsoft's implementation an RPC interface used for providing remote management for security-related policy settings.

Affected Products

MS-LSAD

Impact

Unexpected network communication

Technology

Client-Server

Behavior

• Reasonable

Default Ports

• TCP/135
• TCP/445
• TCP/593
• TCP/1024-5000
• TCP/49152-65535

References

• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-lsad/1b5471ef-4c33-4a91-b079-dfcbb82f05cc