How do you detect AlwaysInstallElevated abuse?

Detect it in three places. Audit and alert on the AlwaysInstallElevated policy value being set to 1 under HKLM or HKCU Policies Windows Installer, since both are required for exploitation and either is a finding. Alert on quiet msiexec invocations that install from user-writable paths or URLs. Then hunt for cmd, PowerShell or rundll32 launched by msiexec running as SYSTEM. Remove the policy through Group Policy, because no managed endpoint needs it, and baseline software-deployment tooling so routine installs stay quiet.

Detecting AlwaysInstallElevated Abuse: Policy Keys and SYSTEM MSI Installs

When both the HKLM and HKCU AlwaysInstallElevated policy values are set to 1, Windows Installer runs any MSI with SYSTEM privileges for any user (T1548.002). An attacker only needs to generate an MSI that runs a command and invoke msiexec quietly. Defenders can audit for the policy, alert on it being set, and watch for the installer spawning interpreters.

Signals at a Glance

Signal	Where	ATT&CK
AlwaysInstallElevated set to 1 under HKLM or HKCU Policies	Sysmon 13, config audit	T1548.002
msiexec with quiet flags and an MSI in a user-writable path or a URL	Sysmon 1, 4688	T1218.007
Interpreter or LOLBin launched by msiexec as SYSTEM	Sysmon 1, EDR	T1548.002
MsiInstaller application events for an unknown product	Application log 1033, 11707	T1218.007
MSI file written to Temp, Downloads or ProgramData just before install	Sysmon 11	T1105

Policy Keys

The weakness needs both keys, so one is not enough to exploit, but either being set is a finding. Audit the current state with the commands below, then alert on any future write:

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
:: Both returning 0x1 means any user can install an MSI as SYSTEM.
:: tune/validate: run from a standard-user context to see the HKCU value that matters.

title: AlwaysInstallElevated Policy Enabled
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: '\Windows\Installer\AlwaysInstallElevated'
    Details: 'DWORD (0x00000001)'
  condition: selection
level: high
# Sysmon logs HKCU writes as HKU SID paths; endswith covers both hives.

The Install Itself

Legitimate MSI deployments arrive from software management tools with predictable parents and paths. An attacker-driven install runs quietly, from a user profile, and often launches a shell as a custom action:

// Microsoft Defender (KQL) - quiet msiexec from user-writable paths or URLs
DeviceProcessEvents
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("/quiet","/qn","/q")
| where ProcessCommandLine has_any ("Temp","Downloads","AppData","ProgramData","http://","https://")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
// Companion hunt: children of msiexec running as SYSTEM
// DeviceProcessEvents | where InitiatingProcessFileName =~ "msiexec.exe" and AccountSid == "S-1-5-18"
//   and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe")

Remediate by setting both values to 0 or deleting them through Group Policy. There is no supported scenario that needs this policy on managed endpoints.
Treat the HKLM write as the higher-severity event, since a standard user cannot create it and its presence implies prior administrative access or a misconfigured baseline.
Correlate MsiInstaller events 1033 and 11707 with the install source path to separate software deployment from user-initiated installs.

Vetted sources

Use the SigmaHQ registry and msiexec rules, Elastic’s prebuilt rules for suspicious installer execution, PowerUp’s AlwaysInstallElevated checks for the attacker view, and Atomic Red Team T1218.007 for validation. Baseline your own environment — software distribution tools run msiexec constantly.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Policy Keys

The Install Itself

Build Detections That Fire

Privilege Escalation Detection

Detection Hub

UAC Bypass Detection