SystemInformer phsvc Trusted Host LPE via rundll32 DLL or SYSTEM Process Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects anomalous activities associated with the SystemInformer (formerly Process Hacker) kernel driver service (phsvc), which is known to be leveraged for local privilege escalation (LPE). The rule identifies the execution of rundll32 with suspicious command line parameters, the spawning of SYSTEM-level child processes by the phsvc service context, and unauthorized access to the SiSvcApiPort named pipe, which is used for inter-process communication with the kernel driver.