UnCanny LPE - Svchost Loading InstallServicePlugin.dll from UNC Path

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

Detects svchost.exe (hosting InstallService) loading InstallServicePlugin.dll from a UNC path, which is indicative of the UnCanny Local Privilege Escalation (LPE) technique. This behavior is suspicious as legitimate svchost processes typically load DLLs from local system paths, not network shares.