C# callback on new process created?

1k Views Asked by At

I want for my callbackMethod() to run whenever a certain new external process is created.

I was looking at the WMI apis, I have read to some extent I can attach an event handler whenever a process is started.

I have looked at this answer: Is there a System event when processes are created? And Created this code:

public static void setupMonitor()
{
    ManagementEventWatcher startWatch = new ManagementEventWatcher(new 
          WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
    startWatch.EventArrived += new EventArrivedEventHandler(callBack);
    startWatch.Start();
}

public static void callBack(object sender, EventArrivedEventArgs e)
{
    int id = Convert.ToInt32(e.NewEvent.Properties["ProcessID"].Value);        
    Process started = Process.GetProcessById(id);
}

How can I get the new process and assign it to a c# Process object?

What I want to know is does this method also send an event if a process created as 'suspended'?

Or do i have to use a different query

Thanks everyone

0

There are 0 best solutions below