SystemInformer phsvc trusted host LPE via rundll32 ALPC port abuse

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects local privilege escalation attempts targeting the SystemInformer PhSvc helper service. The technique involves abusing the trust check within the PhSvc service by using rundll32.exe to connect to the SiSvcApiPort ALPC port and invoke privileged helper APIs, such as PhSvcApiCreateProcessIgnoreIfeoDebugger, to spawn processes with elevated privileges.