SystemInformer PHSVC Trusted Host LPE - SYSTEM Child Process via phsvc IPC
Detects local privilege escalation attempts targeting the SystemInformer service (phsvc.exe) IPC mechanism. The rule identifies suspicious process activity, including the side-loading of a PoC DLL into rundll32.exe, the spawning of child processes from the SystemInformer service context, and the presence of PoC artifacts in system paths, which are used to gain SYSTEM-level execution.
Microsoft Sentinel (KQL)
