# Each of these sections should be run separatedly

# Setup: Create trace

# You can find keywords for a provider with: logman query providers "Provider Name"
# Providing an empty keyword list will return all events

$Providers = @{
    "Microsoft-Windows-Kernel-File" = "KERNEL_FILE_KEYWORD_FILENAME","KERNEL_FILE_KEYWORD_CREATE","KERNEL_FILE_KEYWORD_READ","KERNEL_FILE_KEYWORD_WRITE";
    "Microsoft-Windows-Kernel-Process" = "WINEVENT_KEYWORD_PROCESS","WINEVENT_KEYWORD_THREAD","WINEVENT_KEYWORD_IMAGE";
    "Microsoft-Windows-Kernel-Registry" = @();
    "Microsoft-Windows-Kernel-Network" = @();
}

logman create trace -n PseudoProcMon -o c:\temp\trace.etl

ForEach ($Provider In $Providers.Keys) {
    $KeywordString = ""
    If ($Providers[$Provider].Count -gt 0) {
        $KeywordString = "($($Providers[$Provider] -Join ","))"
    }
    logman update PseudoProcMon -p "$Provider" $KeywordString
}

# Start trace
logman start PseudoProcMon

# Stop trace
logman stop PseudoProcMon