Investigation: AlwaysInstallElevated Installer Policy Enabled

1. Confirm the alert

   Detects the AlwaysInstallElevated installer policy value being set to 1 under Software/Policies/Microsoft/Windows/Installer. When enabled in both HKLM and HKCU, any user can run a crafted MSI as SYSTEM, a classic misconfiguration privilege-escalation path. The rule matched on logsource `registry_set`. Verify the event genuinely matches the described behavior, and not a known legitimate case. The rule matches on these fields — examine the exact value in the event:

   • **TargetObject** contains: `\Software\Policies\Microsoft\Windows\Installer\A`
   • **Details** contains: `0x00000001`

2. Pivot: find the origin and context

   Investigation queries (read-only):

   • Which process wrote the registry key (correlate process_creation, same host/time)
   • Is the value pushed by GPO to other endpoints? (fleet scope)

3. Analyze (D3FEND countermeasures)

   Relevant defensive analysis techniques (MITRE D3FEND), to apply where the telemetry is available:

   • Process Spawn Analysis

4. Rule out false positives

   Known benign causes for this rule:

   • Very rare legitimate deployment tooling may enable this; enabling it is discouraged and warrants review regardless.

5. Response: remediation leads (informational, HITL)

   ⚠️ No automatic action. D3FEND countermeasures for a human to evaluate before any containment/hardening action:

   • Executable Allowlisting
   • Executable Denylisting
   • Hardware-based Process Isolation

6. Context (threat intelligence)

   The rule's references — CTI context to qualify the incident:

   • https://attack.mitre.org/techniques/T1548/002/