Always Install Elevated MSI Spawned Cmd And Powershell

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•17

Detects instances where the Windows Installer service (msiexec.exe) spawns command-line interpreters like cmd.exe or PowerShell.exe. This behavior is often associated with the 'AlwaysInstallElevated' policy being enabled, which can lead to privilege escalation.