intercept process execution

Question

how can my .NET application be informed that an application is about to be executed on the system ?

how can I then prevent if I want that application from executing ?

Duplicate of http://stackoverflow.com/questions/293624/monitor-process-start-in-the-system — Darin Dimitrov, Jul 29 '09 at 09:25
This is not an exact duplicate since there are 2 questions here. — Brian Lyttle, Jul 29 '09 at 09:56

Brian Lyttle · Answer 1 · 2009-07-29T09:55:08.607

There are probably a couple of ways of doing this. The cleanest way to me is only possible in an environment with Active Directory. You can set group policies that control which applications can run. This approach may not be possible for you, or create a number of administrative headaches.

You may also be able to modify the RestrictRun registry key.

There are many articles showing how the System.Diagnostics namespace can be used to get a list of running processes. Your .NET application only really knows that the application is running when it is in he process list. You may be able to do something to discover when it is 'about' to be executed outside of .NET.

Once you find an application is running you can use System.Diagnostics to terminate a process.

score 0 · Answer 2 · edited May 23 '17 at 12:27

0

The 'image hijack' approach that Process Explorer uses should work for this. See my answer here for details.

edited May 23 '17 at 12:27

Community

1
1

answered Apr 21 '10 at 11:33

Luke Quinane

16,447
13
69
88

intercept process execution

2 Answers2