How to fetch new window creation / termination with WQL query?

43 Views Asked by At

Hello Hello Thanks a lot for reading this question.

I am currently building a project which requires to detect new window creation and termination

Current WQL query I am using is following.

hres = pSvc->ExecNotificationQueryAsync(
    _bstr_t("WQL"), 
    _bstr_t("SELECT * " 
        "FROM __InstanceOperationEvent WITHIN 1"
        "WHERE TargetInstance ISA 'Win32_Process'"), 
    WBEM_FLAG_SEND_STATUS, 
    NULL, 
    pStubSink);

However, this just fetches new process creation and termination. Therefore not so useful for my project.

If there is any WQL query that you know which fetches new window creation and termination, please let me know.

I will be grateful.

Again, Thank you so much for reading this question.

0

There are 0 best solutions below