// ntddk.h
typedef enum _PSCREATEPROCESSNOTIFYTYPE {
PsCreateProcessNotifySubsystems
} PSCREATEPROCESSNOTIFYTYPE;
View the official Windows Driver Kit DDI referenceNo description available.
Indicates the type of process notification. This enumeration is used in PsSetCreateProcessNotifyRoutineEx2 to register callback notifications.
PsCreateProcessNotifySubsystemsIndicates that the driver-registered callback is invoked for processes of all subsystems, including the Win32 subsystem. Drivers can call NtQueryInformationProcess to determine the underlying subsystem. The query retrieves a SUBSYSTEM_INFORMATION_TYPE value.
PsSetCreateProcessNotifyRoutineEx2