Is there a System event when processes are created?

Question

Is there any event when a new process is created. I'm writing a c# application that checks for certain processes, but I don't want to write an infinite loop to iterate through all known processes continuously. Instead, I rather check each process that is created or iterate through all current processes triggered by an event. Any suggestions?

        Process[] pArray;
        while (true)
        {
            pArray = Process.GetProcesses();

            foreach (Process p in pArray)
            {
                foreach (String pName in listOfProcesses)  //just a list of process names to search for
                {

                    if (pName.Equals(p.ProcessName, StringComparison.CurrentCultureIgnoreCase))
                    {
                       //do some stuff

                    }
                }
            }

            Thread.Sleep(refreshRate * 1000);
        }

Answer 1

WMI gives you a means to listen for process creation (and about a million other things). See my answer here.

 void WaitForProcess()
{
    ManagementEventWatcher startWatch = new ManagementEventWatcher(
      new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
    startWatch.EventArrived
                        += new EventArrivedEventHandler(startWatch_EventArrived);
    startWatch.Start();
}

static void startWatch_EventArrived(object sender, EventArrivedEventArgs e)
{
    Console.WriteLine("Process started: {0}"
                      , e.NewEvent.Properties["ProcessName"].Value);
    if (this is the process I'm interested in)
    {
             startWatch.Stop();
    }
}

Answer 2

Not sure if it would be within the scope of your application but you can write an API hook for CreateProcess and check at that time.

Answer 3

You steered my in the right direction Michael. Thanks for introducing me to the System.Management namespace. I am quite new to the .net environment and have much to learn.