SystemInformer phsvc Trusted Host LPE via SiSvcApiPort Named Pipe
Detects potential local privilege escalation attempts targeting the SystemInformer PhSvc service. The rule identifies suspicious child processes spawned from rundll32.exe (acting as a proxy) or other common binaries, where the process chain indicates an interaction with the SiSvcApiPort or the use of phsvc-related command-line arguments, potentially leading to unauthorized elevated process creation or service installation.
Cortex XDR
