'How to send custom info to Win32_processStartTrace events
I'm writing an application that monitors process start and process end for a list of processes I'm interested in. Since Win32_ProcessStartTrace doesn't have a processpath, I'm filtering my events based on processName. Once an event arrives, I want to do a further check using the processPath, to make sure I have caught the right application, and avoid any false positives. How do I get the processPath I'm interested in into my StartProcess_EventArrived method? I have the path before the event is raised, but not when the event arrives. I'm aware of using __InstanceCreationEvent which will allow me to filter on processPath, but I don't want my application to consume CPU because of this being an intrinsic event.
void WaitForProcess()
{
var notePadpath = "C:/users/notepad.exe";
ManagementEventWatcher startWatch = new ManagementEventWatcher(
new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace where processname = "notepad.exe""));
startWatch.EventArrived
+= new EventArrivedEventHandler(startWatch_EventArrived);
startWatch.Start();
}
// How can I extract the path of my application in the below method? I don't want to use a global variable.
void startWatch_EventArrived(object sender, EventArrivedEventArgs e)
{
try
{
using (var searcher = new ManagementObjectSearcher("SELECT * FROM Win32_Process WHERE ExecutablePath = " + notePadpath))
}
}
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
