SystemInformer phsvc Trusted Host LPE via rundll32 ALPC Confused-Deputy

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects execution of rundll32.exe with 'phsvc' command line arguments, and the subsequent spawning of potentially malicious child processes (cmd, powershell, wscript, mshta, calc) from the SystemInformer.exe process. This behavior indicates potential abuse of the PhSvcApiCreateProcessIgnoreIfeoDebugger functionality within SystemInformer to bypass debugger-related detection or gain unauthorized execution context.