ProcessHacker Service Privilege Elevation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•21

Detects the creation of a Windows service by the ProcessHacker tool, specifically when the service is configured to run with 'LocalSystem' privileges and its name starts with 'ProcessHacker'. This indicates a potential privilege escalation attempt using ProcessHacker.