// ntfill.h
#if (NTDDI_VERSION < NTDDI_WIN10_RS2)

typedef enum _PSCREATEPROCESSNOTIFYTYPE
{
    PsCreateProcessNotifySubsystems = 0

} PSCREATEPROCESSNOTIFYTYPE;

#endif
View code on GitHub

// ntddk.h

typedef enum _PSCREATEPROCESSNOTIFYTYPE {
  PsCreateProcessNotifySubsystems
} PSCREATEPROCESSNOTIFYTYPE;
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (ne-ntddk-_pscreateprocessnotifytype)

_PSCREATEPROCESSNOTIFYTYPE enumeration

Description

Indicates the type of process notification. This enumeration is used in PsSetCreateProcessNotifyRoutineEx2 to register callback notifications.

Constants

`PsCreateProcessNotifySubsystems`

Indicates that the driver-registered callback is invoked for processes of all subsystems, including the Win32 subsystem. Drivers can call NtQueryInformationProcess to determine the underlying subsystem. The query retrieves a SUBSYSTEM_INFORMATION_TYPE value.