Windows AlwaysInstallElevated Privilege Escalation Recon
Detects registry query for AlwaysInstallElevated — precursor to MSI-based privilege escalation.
Sigma

Detects registry query for AlwaysInstallElevated — precursor to MSI-based privilege escalation.

Already have an account?