SystemInformer PHSVC Trusted Host LPE via SiSvcApiPort Named Pipe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects indicators of the SystemInformer PHSVC (Process Hacker Service) local privilege escalation proof-of-concept. The rule monitors for the loading of the PoC DLL by rundll32, the execution of commands containing specific PoC strings, and the spawning of shell processes by PHSVC-related parent processes.