SystemInformer PHSVC Trusted-Host LPE via rundll32 ALPC Port Abuse

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects local privilege escalation attempts targeting the SystemInformer (formerly Process Hacker) PHSVC service. Adversaries can abuse the SiSvcApiPort ALPC port by using rundll32.exe to load specific malicious payloads that call privileged service APIs, such as PhSvcCreateProcessIgnoreIfeoDebugger or PhSvcCreateService, effectively bypassing standard user restrictions.