Windows AlwaysInstallElevated Privilege Escalation Recon

Detects registry query for AlwaysInstallElevated — precursor to MSI-based privilege escalation.