If you run the code, it will remove the ACL for all the services in the serviceHashList list. On reboot, these services will not start.

#sunburst is as we know stealthy, and does not reboot the computer, it rather waits for the computer to be rebooted.

#sunburst will iterate over all entries in the registry, and if it finds a match, clear the ACL of that key, and then set the owner to the local Administrator account.

#sunburst does not kill the process of the AV, it rather changes the ownership and permissions of the service entry in HKLM:/System/CurrentControlSet/services

cc @MalwareJake @GossiTheDog @SwiftOnSecurity

The reason it aborts when sysmon is running, is probably that sysmon creates an event log if the service is not able to start after a reboot.

raw.githubusercontent.com/ept-team/sunbu…

The assemblyTimeStamps (process list) is used to see if any of these processes are running, if so, the execution aborts.