track process execution

[Detector 0]

Hello,

 

Looking for some realiable fast and stable method to track programs executed.

Function/program should add to list new program executed.

Is that possible without driver to make it works?

 

[Der schöne Günther 316]

Your question is relatively vague.

I guess the technical definition of "programs executed" means "whenever the WinApi CreateProcess(..) routine is called"?

 

In that case, the Microsoft or MahdiSafsafi libraries are probably the fastest way:

• https://github.com/MahdiSafsafi/DDetours
• https://github.com/microsoft/detours/wiki/Using-Detours

[David Heffernan 2345]

No need to hook anything. And in any case, what would you hook? Every process in the entire system?

 

The system raises WMI events when processes are created and destroyed.

 

https://stackoverflow.com/questions/47147099/is-there-a-way-to-recieve-a-event-about-a-process-starting-in-windows