BamboozlEDR

BamboozlEDR provides several modes for generating events depending on your testing requirements:

• Single Events: Generate individual events for specific testing scenarios.
• Batch Events: Generate multiple events from predefined lists.
• BamboozlEDR: Execute multiple events simultaneously to test EDR confusion/noise handling.
• Buffer Overflow: Generate unlimited high-volume events from all providers simultaneously for stress testing.
• Custom Events: Generate events with custom parameters.

While the application works with standard privileges, certain advanced features require Administrator privileges:

• ETW trace monitoring: Only available when running as administrator.
• NotMDE ETW Trace Monitor: Allows creating/managing external ETW trace sessions with the same providers used by Microsoft Defender for Endpoint (MDE).

After compilation, follow these steps to use the tool within Cobalt Strike:

1. Load the aggressor script: Use the script-load command pointing to the generated .cna file in the output/ directory.
2. Execute the command: Use the antimalware_events command followed by a mode integer.

Modes:

• 1: Ransom Detection Mode. Emits multiple ransomware-related threat detections (e.g., Ransom:PowerShell/Roduk, Ransom:Win32/Blocker).
• 2: Random Threat Mode. Emits a single random threat detection from a predefined pool (e.g., Trojan:Win64/CobaltStrike.UFO!MTB).

# Load the script
script-load output/antimalware_events.cna

# Generate all ransom detection events
antimalware_events 1

# Generate a single random threat detection
antimalware_events 2

To compile the Beacon Object File (BOF) and the accompanying Cobalt Strike aggressor script, run the provided batch script. This script automates the detection of Visual Studio and handles the compilation of the C source code into an object file, while also preparing the .cna script in the output directory.

build_antimalware.bat

The Buffer Overflow mode is optimized for maximum throughput. It runs 6 concurrent providers simultaneously using several performance optimizations:

• Real-Time TUI Display: Shows live statistics (success/failure counts, total events, events per second) in a table.
• Pre-allocated GUID Pool: Uses a 100,000 GUID pool to avoid allocation overhead.
• Reduced String Conversions: Optimized UTF-16 encoding.
• Streamlined Event Generation: Minimal overhead event structures.
• Intelligent Logging: Logs are emitted every 1000 events to minimize performance impact.
• Cycle-Based Selection: Uses efficient data cycling instead of expensive random generation.

BamboozlEDR includes a high-performance 'Buffer Overflow Mode'. When this mode is active:

• All ETW Providers are activated simultaneously.
• The application provides real-time statistics in the UI.
• It is designed for maximum throughput to test how security tools handle high volumes of ETW events.

To stop all functions while in this mode, press ESC.

BamboozlEDR provides two high-intensity modes for overwhelming EDR capabilities:

Buffer Overflow Mode

This is the maximum throughput mode. It initializes advanced performance optimizations and starts multiple infinite spam functions in parallel across many providers (Antimalware, LDAP, TCP/IP, WMI, AMSI, DPAPI, PowerShell, CodeIntegrity, and AppLocker). It also includes a real-time statistics updater.

Bamboozle Mode

This is a parallel spam mode. It executes a subset of high-impact spam attacks simultaneously (LDAP, TCP/IP, Antimalware, DPAPI, PowerShell, CodeIntegrity, and AppLocker) to hit provider capping limits at the same time.

In both modes, you can press ESC to stop all active spam functions and return to the main menu.

When generating a PowerShell Commandlet event (ID 7937), the following three string fields are emitted as event data:

1. ContextInfo: Metadata about the execution environment (e.g., Script Block ID, Engine Version, Host Name, Runspace ID).
2. UserData: Information about the user or session context (e.g., User: DOMAIN\admin, Elevation: Administrator, Logon Type: Interactive).
3. Payload: The actual command string being executed (e.g., Invoke-Mimikatz -Command '"sekurlsa::logonpasswords"').

When generating an AMSI event (ID 16385), the following two string fields are emitted as event data:

1. Action: The AMSI operation being performed (e.g., AMSI_SCAN_STRING, AMSI_RESULT_DETECTED).
2. AmsiContext: The context in which AMSI is operating (e.g., PowerShell Script Block, Office VBA, Windows Script Host).

The WriteCyberEvent function allows for the emission of simulated Microsoft Defender for Endpoint (MDE) cyber events into an ETW trace session. It reads telemetry data from a local JSON file and converts it into ETW events using the Microsoft.Windows.Sense.CyberEvents provider.

Requirements & Behavior:

• Input File: The function expects a JSON file located at telemetry/sense-output.json.
• Permissions: To successfully emit events into the trace session, the process must be running as SYSTEM.
• Provider Details: It uses the provider GUID {cb2ff72d-d4e4-585d-33f9-f3a395c40be7} and the name Microsoft.Windows.Sense.CyberEvents.
• Note: This implementation is intended for Proof of Concept (POC) and debugging; events emitted this way are not intended to show up in the MDE console.