SystemInformer PHSVC Trusted Host LPE - rundll32 DLL Load and Unexpected Child Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential abuse of System Informer's phsvc service for privilege escalation or execution via rundll32, as well as unauthorized child process spawning by the SystemInformer process. This behavior is associated with proof-of-concept exploits targeting the System Informer service.