SystemInformer PhSvc Trusted-Host LPE via rundll32 ALPC Abuse

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects exploitation of the SystemInformer phsvc service via ALPC port abuse and trusted-host bypass. The attack involves loading a malicious DLL into the Microsoft-signed rundll32.exe process to bypass trust checks, subsequently connecting to the '\BaseNamedObjects\SiSvcApiPort' to invoke privileged APIs for LPE.