$RegistryPath1 = 'HKCU:\Software\Policies\Microsoft\Windows\Installer'
$RegistryPath2 = 'HKLM:\Software\Policies\Microsoft\Windows\Installer'
$Name = 'AlwaysInstallElevated'
$Value = '1'

Create the key if it does not exist

New-Item -Path $RegistryPath1 -Force | Out-Null
New-Item -Path $RegistryPath2 -Force | Out-Null

Now set the value

New-ItemProperty -Path $RegistryPath1 -Name $Name -Value $Value -PropertyType DWORD -Force
New-ItemProperty -Path $RegistryPath2 -Name $Name -Value $Value -PropertyType DWORD -Force

https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6

no spam

le tool crash avec python 3.9+ car la méthode thread.isAlive() a été silent retired. du coup faut backtrack sur thread.is_alive():

Quickfix:

alias rgi="ripgrep -i"
for file in $(rgi isAlive | less | cut -d ":" -f1 | sort -u); do sed -i 's/isAlive/is_alive/g' $file ; done

write up from https://sirleeroyjenkins.medium.com/bypassing-ssrf-protection-to-exfiltrate-aws-metadata-from-larksuite-bf99a3599462