FileSystemWatcher used to watch for folder/file open

Question

I have browsed around but cannot find any information on what I am seeking, if there is another post that already goes over this then I apologize.

I am seeking help

Answer 1

Digvijay Rathore gave already an answer, in my opinion the only good answer, even if a bit too short.

I want just to add a few words and a link where interested users could start.

The FileSystemWatcher is useful just to monitor what is happening inside the monitored folder, but it's not able to monitor and intercept what the user (or the OS) is doing.

For example, with a FSW (FileSystemWatcher) you can monitor when a file/folder is created, deleted, renamed or changed in some way, and those events are unleashed AFTER the action is completed, not before nor while.

A simple FSW is not able to know if the user is launching an executable from the monitored folder, in this case it will simply generate no events at all.

To catch when an executable is launched (and tons of other "events") before it is launched and make some action before the code of the executable is loaded in memory, you need to write something at lower (kernel) level, that is, you need to build a driver, in this specific case a (minifilter) File System driver.

This is a good starting point to start to understand the basic of Minifilter Windows Drivers:

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/file-system-minifilter-drivers