SystemInformer phsvc Trusted Host LPE via rundll32 IPC Abuse

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects potentially malicious activity involving System Informer (formerly Process Hacker) or its associated service (phsvc) spawning suspicious child processes like cmd.exe or using rundll32.exe to execute specific DLL-based proofs-of-concept. These patterns are often associated with privilege escalation or evasion techniques using these tools' service drivers.