.\Metamorph.exe <options>

# Enable only providers from Defender
.\Metamorph.exe -Defender

# Enable providers from Defender and MDE, merging duplicates
.\Metamorph.exe -Defender -MDE

# Enable all providers from all engines, merging duplicates
.\Metamorph.exe -All

# Enabling one provider, also with noisy ones, because why not filling disk space after all?
.\Metamorph.exe -All -noisy

tracerpt MyKeywordMergedETWLogger.etl -o logdump.csv -of CSV

[Reflection.Assembly]:https://raw.githubusercontent.com/synacktiv/metamorph/main/:Load(%5BSystem.Convert%5D::FromBase64String(%22TVqQAAMAAAAEAAAA/8AALgAAAAAAAAAQAAAAAA%5B...%5DAAAAAAAAAAAAA%22))


#Récupération du handle sur le process cible
    $ProcessDesiredAccess = 0x00000400
    $InheritHandle = 0
    $ProcessId = $PID
    $hProcess = [api32.run]::OpenProcess($ProcessDesiredAccess, $InheritHandle, $ProcessId)
    if($hProcess -eq 0){ Write-Output "OpenProcess Error" }

#Récupération du handle sur le token du process cible
    $hToken = [IntPtr]::Zero
    $TokenDesiredAccess = 0x00000006
    $Success = [api32.run]::OpenProcessToken($hProcess, $TokenDesiredAccess, [ref]$hToken)
    if(-not $Success){ Write-Output "OpenProcessToken Error" }
    
#Duplication du token
    $DesiredAccess = 0x10000000
    $SecurityAttribute = New-Object api32.run+_SECURITY_ATTRIBUTES
    $SecurityAttribute.lpSecurityDescriptor = [IntPtr]::Zero
    $SecurityAttribute.bInheritHandle = $true
    $ImpersonationLevel = 3
    $TokenType = 1
    $hDuplicatedToken = [IntPtr]::Zero
    $Success = [api32.run]::DuplicateTokenEx($hToken, $DesiredAccess,[ref]$SecurityAttribute, $ImpersonationLevel, $TokenType,[ref]$hDuplicatedToken)
    if(-not $Success) { Write-Debug "DuplicateTokenEx Error" }

#Creation du cmd avec le token dupliqué
    $LogonFlags = 0
    $ApplicationName = "cmd.exe"
    $CommandLine = "/K whoami /all"
    $CreationFlags = 0x00000010
    $Environnement = [IntPtr]::Zero
    $CurrentDirectory = "c:\windows\system32"
    $StartUpinformation = New-Object api32.run+STARTUPINFOA                                    
    $ProcessInformation = New-Object api32.run+_PROCESS_INFORMATION
    $Success = [api32.run]::CreateProcessWithTokenW($hDuplicatedToken, $LogonFlags,$ApplicationName, $CommandLine, $CreationFlags, $Environnement, $CurrentDirectory, [ref]$StartUpinformation,[ref]$ProcessInformation)
    if(-not $Success) { Write-Debug "CreateProcessWithTokenW Error" }