MSI

Windows Privesc

Abusing AlwaysInstallElevated for Windows Privilege Escalation

How a misconfigured AlwaysInstallElevated policy lets a low-privileged user run a malicious MSI as SYSTEM, plus detection and defense.