I want for my callbackMethod()
to run whenever a certain new external process is created.
I was looking at the WMI apis, I have read to some extent I can attach an event handler whenever a process is started.
I have looked at this answer: Is there a System event when processes are created? And Created this code:
public static void setupMonitor()
{
ManagementEventWatcher startWatch = new ManagementEventWatcher(new
WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
startWatch.EventArrived += new EventArrivedEventHandler(callBack);
startWatch.Start();
}
public static void callBack(object sender, EventArrivedEventArgs e)
{
int id = Convert.ToInt32(e.NewEvent.Properties["ProcessID"].Value);
Process started = Process.GetProcessById(id);
}
How can I get the new process and assign it to a c# Process
object?
What I want to know is does this method also send an event if a process created as 'suspended'?
Or do i have to use a different query
Thanks everyone