RegistryCallback and RegCreateKeyEx
问题 I want to monitor a windows machine. I created a windows service, and my purpose is to be notified when a process tries to create a new registry key. I use RegistryCallback with the following signature NTSTATUS RegistryCallback( _In_ PVOID CallbackContext, _In_opt_ PVOID Argument1, _In_opt_ PVOID Argument2 ) The RegistryCallback was registered with CmRegisterCallback . The problem is I am notified for every registry key creation , however I want to be notified only for creation of new