SystemInformer phsvc Trusted-Host LPE via rundll32 ALPC Port Abuse

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects the execution of specific command-line strings and DLL loading associated with Proof-of-Concept (PoC) exploits targeting the System Informer (formerly Process Hacker) kernel driver service (phsvc). These patterns indicate potential attempts to interact with or exploit the driver for unauthorized purposes, such as privilege escalation.