请查看
ManagementEventWatcher类。
具体而言,链接底部的代码示例向您展示如何设置ManagementEventWatcher以在创建新进程时通知您。
代码从MSDN代码示例中复制(可能需要进行一些清理):
using System;
using System.Management;
public class EventWatcherPolling
{
public static int Main(string[] args)
{
WqlEventQuery query =
new WqlEventQuery("__InstanceCreationEvent",
new TimeSpan(0,0,1),
"TargetInstance isa \"Win32_Process\"");
ManagementEventWatcher watcher =
new ManagementEventWatcher();
watcher.Query = query;
watcher.Options.Timeout = new TimeSpan(0,0,5);
Console.WriteLine(
"Open an application (notepad.exe) to trigger an event.");
ManagementBaseObject e = watcher.WaitForNextEvent();
Console.WriteLine(
"Process {0} has been created, path is: {1}",
((ManagementBaseObject)e
["TargetInstance"])["Name"],
((ManagementBaseObject)e
["TargetInstance"])["ExecutablePath"]);
watcher.Stop();
return 0;
}
}
编辑
添加了TargetInstance.Name = 'someProcess'
过滤器的简化示例。
var query = new WqlEventQuery(
"__InstanceCreationEvent",
new TimeSpan(0, 0, 1),
"TargetInstance isa \"Win32_Process\" and TargetInstance.Name = 'someProcess'"
);
using(var watcher = new ManagementEventWatcher(query))
{
ManagementBaseObject e = watcher.WaitForNextEvent();
//someProcess created.
watcher.Stop();
}