Tools & Defense Windows Registry Forensics for DFIR
Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these t...
Registry
Tools & Defense 
Windows Privesc Abusing AlwaysInstallElevated for Windows Privilege Escalation
How a misconfigured AlwaysInstallElevated policy lets a low-privileged user run a malicious MSI as SYSTEM, plus detection and defense.
Windows Privesc Abusing Registry Autoruns for Windows Persistence and Privilege Escalation
How attackers abuse writable Run keys and other autorun locations for persistence and privesc, plus how blue teams detect it.