### Overview
After initial access via the compromised SolarWinds update, the SUNBURST backdoor activates on the affected systems. This report delves into the mechanisms behind the activation.

### Key Observations
- **Activation Timing**: SUNBURST is designed to delay its execution to avoid raising immediate suspicion.
- **Execution Methods**: Utilizes a combination of Windows processes to blend in with legitimate operations.

### Recommendations
- Conduct a thorough review of system logs during the initial days of compromise to identify unusual process behaviors.

### Next Steps
Prepare for potential persistence mechanisms adopted by SUNBURST to maintain foothold.