CVE-2026-20181 SystemInformer PHSVC Trusted Host LPE via rundll32 ALPC Abuse
This rule monitors for suspicious activities related to System Informer (formerly Process Hacker) and its associated service (phsvc.exe). It detects unauthorized or unusual execution patterns, such as unsigned client binaries, shell spawning, or the use of specific proof-of-concept (PoC) command-line arguments that indicate attempts to abuse the service's privileged capabilities for process management or evasion.
Splunk (SPL)
