SystemInformer PHSVC Trusted Host LPE via rundll32 ALPC Abuse
Detects exploitation of the SystemInformer PhSvc service by monitoring for rundll32.exe launching with command-line arguments indicative of loading a proof-of-concept DLL and attempting to communicate with the SiSvcApiPort ALPC port. This activity is associated with abusing privileged helper APIs to perform unauthorized SYSTEM-level process creation or service installation.
YARA-L
