BamboozlEDR: New Tool Generates Realistic ETW Events to Test EDR Detection

BamboozlEDR

A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes. BamboozlEDR features a TUI interface and can generate realistic security events across multiple Windows ETW providers to test EDR detection capabilities, log analysis systems, and security monitoring solutions.

Note: This tool is built as a Proof-of-Concept. It is not polished code and it is intentionally built as a TUI utility that requires some user interaction to work. This limits the abuse by skiddies.

Features

• Microsoft-Windows-Antimalware – Threat detection events (Event ID 48)
• Microsoft-Windows-Antimalware-RTP – Real-time protection events (Event IDs 27, 14)
• Microsoft-Windows-LDAP-Client – LDAP search and authentication events
• Microsoft-Windows-TCPIP – TCP/IP connection events
• Microsoft-Windows-WMI-Activity – WMI query and execution events (Event IDs 22, 11)
• Microsoft-Windows-AMSI – AMSI scan events
• Microsoft-Windows-Defender – Windows Defender events (Event IDs 5000, 5001, 1116, 1117)
• Microsoft-Windows-DotNETRuntime – .NET runtime events
• Microsoft-Windows-Crypto-DPAPI-Events – DPAPI access events
• Microsoft-Windows-Security-Auditing – Security audit events (Event ID 4688)
• Microsoft-Windows-PowerShell – PowerShell commandlet and AMSI events
• Microsoft-Windows-RPC – RPC function trace events (Event ID 14)
• Microsoft-Windows-CodeIntegrity – Code Integrity events (Event IDs 3023, 3036, 3076, 3077)
• Microsoft-Windows-AppLocker – AppLocker events (Event IDs 8003, 8004, 8006, 8007, 8021, 8022, 8024, 8025)
• Microsoft-Windows-NTLM – NTLM blocking events (Event ID 8001)

• Single Events – Generate individual events for testing
• Batch Events – Generate multiple events from predefined lists
• BamboozlEDR – Execute multiple events simultaneously to confuse EDR
• Buffer Overflow – Generate unlimited high-volume events from all providers simultaneously
• Custom Events – Generate events with custom parameters

• Static analysis detection of threat names
• String-based signature matching
• Binary analysis tools finding embedded threat data

The obfuscation is applied at compile time and strings are deobfuscated only at runtime when needed, ensuring no plain text threat names exist in the binary file.

• Conditional Feature Access – ETW trace monitoring only available when running as administrator
• Graceful Degradation – Application works normally without admin privileges

1. Microsoft-Antimalware-RTP – Generate real-time protection events
2. Microsoft-Windows-AMSI – Generate AMSI provider events
3. Microsoft-Windows-Antimalware – Generate antimalware detection events
4. Microsoft-Windows-AppLocker – Generate AppLocker events
5. Microsoft-Windows-CodeIntegrity – Generate Code Integrity events
6. Microsoft-Windows-Crypto-DPAPI-Events – Generate DPAPI access events
7. Microsoft-Windows-DotNETRuntime – Generate .NET runtime events
8. Microsoft-Windows-Ldap-Client – Generate LDAP client events
9. Microsoft-Windows-NTLM – Generate NTLM blocking events
10. Microsoft-Windows-PowerShell – Generate PowerShell events
11. Microsoft-Windows-RPC – Generate RPC function trace events
12. Microsoft-Windows-TCPIP – Generate TCP/IP network events
13. Microsoft-Windows-WMI-Activity – Generate WMI activity events
14. Microsoft-Windows-Windows Defender – Generate Windows Defender events
15. Cyber events – Simulate cyber attack events
16. BamboozlEDR – Execute multiple events to confuse EDR
17. Buffer Overflow – Generate unlimited events from all providers
18. User-Mode Antimalware Trace – Monitor Microsoft-Antimalware-Engine (no admin required)

19. NotMDE ETW Trace Monitor – Create/manage external ETW trace session with the same providers MDE relies on.

• Single random malware event – Generate one random malware detection
• Single random benign event – Generate one random benign detection
• Spam malware events – Generate multiple malware detections
• Spam benign events – Generate multiple benign detections
• Ransomware – Generate ransomware detection

• RTP detection events – Generate real-time protection detection events (27 + 14)

• Single AMSI event – Generate AMSI scan event
• Suspicious AMSI events – Generate suspicious AMSI scans
• Spam AMSI events – Generate multiple AMSI scans

• Process Audit (8003) – Generate AppLocker process audit event
• Process Block (8004) – Generate AppLocker process block event
• Script Audit (8006) – Generate AppLocker script audit event
• Script Block (8007) – Generate AppLocker script block event
• Appx Process Audit (8021) – Generate AppLocker Appx process audit event
• Appx Process Block (8022) – Generate AppLocker Appx process block event
• Appx Script Audit (8024) – Generate AppLocker Appx script audit event
• Appx Script Block (8025) – Generate AppLocker Appx script block event
• Spam AppLocker events – Generate multiple random AppLocker events

• Revoked Driver (3023) – Generate CiRevokedDriverNotLoaded event
• Revoked Image (3036) – Generate CiRevokedImageNotLoaded event
• Policy Failure Audit (3076) – Generate DeviceGuard policy failure audit
• Policy Failure Block (3077) – Generate DeviceGuard policy failure
• Spam CodeIntegrity events – Generate multiple random CodeIntegrity events

• Single DPAPI event – Generate single DPAPI access event
• Spam DPAPI events – Generate multiple DPAPI events
• Infinite DPAPI events – Generate DPAPI events continuously

• Single .NET event – Generate .NET runtime event
• Malicious .NET event – Generate malicious .NET event
• Spam .NET events (1337) – Generate multiple .NET events

• ADExplorer event – Generate ADExplorer LDAP search
• SharpHound events – Generate SharpHound LDAP searches
• Spam LDAP events – Generate multiple LDAP searches

• NTLM Blocking Event (8001) – Generate single NTLM blocking event
• Spam NTLM events – Generate multiple random NTLM blocking events

• Single Random PowerShell event – Generate single random PowerShell commandlet event
• Random PowerShell AMSI event – Generate random PowerShell AMSI scan event
• Spam PowerShell events – Generate multiple mixed PowerShell events

• Function trace event – Generate RPC function trace event (14)

• Spam TCP/IP events – Generate multiple network events
• SMB Scan TCP/IP events – Generate SMB scanning events
• Single Random TCP/IP event – Generate one random network event
• Single Kerberos TCP/IP event – Generate Kerberos network event
• Single SMB TCP/IP event – Generate SMB network event

• Single WMI Event 22 – Generate WMI activity event
• Suspicious WMI Events 22 – Generate suspicious WMI activity
• Spam WMI Events 22 – Generate multiple WMI events
• Single WMI Event 11 – Generate WMI event type 11
• Suspicious WMI Events 11 – Generate suspicious WMI type 11
• Spam WMI Events 11 – Generate multiple WMI type 11
• Local WMI Event 11 – Generate local WMI event
• Remote WMI Event 11 – Generate remote WMI event

• Realtime protection enabled (5000) – Generate defender enabled event
• Realtime protection disabled (5001) – Generate defender disabled event
• Malware detected + Remediated (1116/1117) – Generate malware detection event
• Spam Defender events – Generate multiple defender events

The Buffer Overflow feature runs optimized ETW providers simultaneously at maximum throughput:

• Real-Time TUI Display – Clean table interface showing statistics per provider
• Live Statistics – Success/failure counts, total events, and events per second
• Advanced Performance Optimizations – 100,000 pre-allocated GUID pool, reduced string conversions
• Streamlined Event Generation – Simplified event structures for maximum speed
• 6 Concurrent Providers – Focused on highest-volume providers for optimal performance
• Intelligent Logging – Reduced frequency (every 1000 events) to minimize overhead
• Cycle-Based Selection – Efficient data cycling instead of expensive random generation
• Auto-Refresh Display – Updates every 2 seconds with current statistics
• Enhanced Error Reporting – Descriptive Windows error codes instead of cryptic numbers

Download

Support Our Threat Intelligence

If you find our technology report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy