Always Install Elevated Windows Installer

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the Windows Installer service (msiexec.exe) attempting to install MSI packages with SYSTEM privileges, which can be indicative of privilege escalation through the 'AlwaysInstallElevated' policy.