SystemInformer phsvc trusted host LPE via rundll32 ALPC port abuse
Detects evidence of a local privilege escalation attempt targeting the SystemInformer (formerly Process Hacker) phsvc service. The detection identifies the loading of a known proof-of-concept DLL into rundll32.exe, the creation of specific indicator files on disk, or rundll32.exe executing command-line payloads associated with the exploit.
Microsoft Sentinel (KQL)
