Disable or Modify Tools × Sysmon

modifies ACLs on kernel32.dll to add Deny ACEs for Windows Defender and Sysmon service identities, preventing them from starting after reboot

With admin rights, the tool adds Deny ACEs to the ACL of kernel32.dll targeting specific service SIDs. When the system reboots, the services cannot read kernel32.dll, breaking their dependency chain and preventing them from starting. The effect is delayed until reboot, making immediate detection difficult.

Monitor for Windows Security Event ID 4670 (permissions change) on critical system files like kernel32.dll, especially when the new ACL includes Deny ACEs targeting security service SIDs (e.g., Windows Defender, Sysmon). Mitigate by enforcing least-privilege admin access, hardening ACLs on key DLLs, and using file integrity monitoring to alert on unauthorized permission changes.