W-ALWAYS-ELEVATEPrivilege Escalation

AlwaysInstallElevated

HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 1 — any MSI runs as SYSTEM.

§ Where this technique fits

W-ALWAYS-ELEVATE is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

AlwaysInstallElevated → SYSTEM via MSI
Both HKCU and HKLM AlwaysInstallElevated policies set to 1 — any user-installed MSI runs as SYSTEM. Drop a malicious MSI and install it.
step 4 / 5

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

AlwaysInstallElevated → SYSTEM via MSI

§ What commonly comes next