SystemInformer PHSVC Trusted Host LPE — Elevated Process via Named Pipe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects local privilege escalation attempts targeting the SystemInformer (ProcessHacker) PHSVC service. The rule identifies suspicious child process execution from trusted hosts (rundll32.exe, SystemInformer.exe) occurring simultaneously with a connection to the SiSvcApiPort named pipe, which is indicative of the abuse of the SystemInformer service channel for privilege escalation.